Renamed `swid_log` url to `log`
Require login for swid views and statistics
Added a `fields` param to all API endpoints

The API now allows a new `fields` parameter that can filter returned
fields per document.

The fields need to be comma separated, without any spaces.

- Correct: `fields=id,url,packageName`
- Wrong: `fields=id&fields=url`
- Wrong: `fields=id, url`

Nested entities can be shown or hidden, but their fields cannot be
filtered.
Fixed failing 2==3 test
Revised SWID inventory
Removed all users and sessions from default db
Switched to custom API permission class

Access to the API is granted in two cases:

- User is an admin (`is_staff=True`)
- User has the `auth.write_access` permission

Otherwise, the user is rejected with a HTTP 401 or HTTP 403 status.
Added CSRF_COOKIE_SECURE to settings.ini
Enabled clickjacking protection
Added paging to potentially large tables