Testcases for Questions and Answers API.

All API calls as of this commit should now have a corresponding test
case. Test cases were reorganized to split them into classes depending
on which API they test.

Responsibility for the insertion of a default criteria for newly created
course was pushed back to the model level where on each access to the
list of criterias, the model will check if it it needs to insert a
default criteria for itself. Note that it was done this way because the
sqlalchemy event system did not seem to work on the test case side even
though it seems to work fine during normal operation.

A standard pattern for test cases seem to have emerged, some effort
should probably be taken to use this pattern to simplify testing
somehow. All test cases seem to test these items:
 - Make sure that unauthenticated users are refused access with 401 Auth
   Required
 - Authenticated users that does not have enough permissions are refused
   access with a 403 Forbidden
 - Non-existent entries should error out with a 404
 - If it's a post request, some effort should be made to ensure that
   invalid formats are rejected with 400 Bad Request