Fixes #2457: Admin auth required to modify playlist assignments (both API and page load)

Fixes #2457.

Includes new auth decorator and tests of API endpoint.
Nice catch with this one. This was an artifact of when I was testing with `test_playlist.json`. Surprised this was only removed now.