Add settings to user profile, hidden behind auth..

The user settings API works very much like the questions metadata API. And I discovered that the questions metadata API is broken. I fixed the question metadata API, kind of. I implemented the user settings API the same way. I hid the settings API with a new field I made that hides it uniless certain conditions are met. In this case I check for a logged in user that matches the user being queried. I also put email address in a field like that too.

I'm really not satisfied with how DRF and our metadata-like models interact. I'm not sure what to do about that. I tried making a field/serializer thing that acted like a dictionary, but couldn't get it to work.

@willkg I'm curious what you think about the PermissionsMod class. It's the field decorator we talked about that implements the permission fields.

r?
Oh, yeah. `.save()` is required. I'll add more tests.