Project space metadata

implements
https://docs.google.com/a/dimagi.com/document/d/1ZpdRZLSstmnW_ubertb2jAMphssyOct_kWQ8YhpOhA0/edit#heading=h.i0ohvkukphfh

Restricts permission to domain admins (superusers permitted)

I chose not to use tastypie, since it would have been a mess to integrate with non-django ORM data
since you know there's going to be a domain arg you might as well make it explicit