Add django-mptt to the requirements.txt file.
Added keys to roles in fixture data.
View tests check for multiple unauthorised HTTP error codes.

Depending on the authentication method, the view would return a 401 or a
403, so now both are checked.
Use session authentication in debug mode for convenience.

OAuth is a pain to use in development.