Project space metadata

implements
https://docs.google.com/a/dimagi.com/document/d/1ZpdRZLSstmnW_ubertb2jAMphssyOct_kWQ8YhpOhA0/edit#heading=h.i0ohvkukphfh

Restricts permission to domain admins (superusers permitted)

I chose not to use tastypie, since it would have been a mess to integrate with non-django ORM data
that just checks that they are a member of the domain, not that they have admin permissions.