Feature/auth permissions

Note that this MR will break the angular app gtfs upload page until we implement token auth client side.

Also requires a DROP DATABASE transit_indicators and a re-provision. 

See commit comments for further info.


Yup. Relevant source:
https://github.com/django/django/blob/1.7c1/django/contrib/auth/models.py#L360

The documentation doesn't mention the AbstractUser model until almost the end of the page, so I missed it when I wrote the original user model.