Added roles and permissions.
Renamed session app to api_auth.

The api_auth should handle the user management/authorisation side of the
api itself.
Permission and Role classes moved to common package.

Both the api and core game needs this (for managing both api permissions
and website/operational permissions).
Created system model class to avoid creation of meta classes.
Added api auth models.
Include api accounts and permissions in admin.
Removed duplicate entry for auth options in settings.
Removed api_auth session classes/views for now.
Removing the api_auth module.

Turns out OAuth will do what is needed.
Require authorisation by default for non read-only actions.
Remove api_auth module from coverage.
Use django-oauth-toolkit for authorisation.