Implement write-only surge predictions endpoint

NOTE: merge after the other PR

ie `/1/predictions/surge-levels/liverpool-gladstone-dock/`

Insertions are authenticated by providing the HTTP Authorization header
with a token associated with a valid user with the correct permissions.

We're using django rest framework 3.0.0 which isn't yet released, but the
serializer API is substantially rewritten so it doesn't make sense to
build on 2.4.x.

- ability to create & update surge predictions
- disallow HTTP GET
- UTC datetime validity checking
- failure in 1 record aborts write of *all* records in that request
- token authentication:

  * requires header: `Authorization: Token xxx`
  * token must belong to a Django user
  * Django user must have `create_surgeprediction` permission
  * HTTP 401 / 403 for header missing / forbidden

Note that we currently implement our own (inefficient) bulk-save. See
https://github.com/tomchristie/django-rest-framework/issues/1965

https://www.pivotaltracker.com/story/show/80542816
https://www.pivotaltracker.com/story/show/78037278