Csv export auth

Sorry this is from learningequality to learningequality. I think because of some trouble with the kalite-submodule (working from the central codebase) I set my origin to learningequality rather than my own fork and forgot about it. 

Summary: Adds 3 api endpoints (FacilityUser, TestLog, and AttemptLog), which allow filtering based on zone, facility, or group, and return the appropriate data serialized to CSV. Also includes a backbone app which serves as the front-end for the API. Pics below. 

From central server, admins can select combination of zone, facility, student group, and resource type (users, test, or attempts:

![selection_067](https://cloud.githubusercontent.com/assets/1319950/4172155/11550ebc-3545-11e4-8767-4d0c799a280e.png)

On distributed, same idea, minus the ability to select zone:
![selection_068](https://cloud.githubusercontent.com/assets/1319950/4172159/20a60a9c-3545-11e4-87fe-bed2d563a0fc.png)

Lingering issues:
* no tests yet (although works in manual testing) 
* currently returns a blank CSV when an admin picks a combination that returns 0 results. Eg if there are no students at a facility and they click export, it will be empty rather than returning an error message. Currently this is by design, but we could handle it better in future. 
* File names are currently just 'download' without an extension. I couldn't figure out how to do this easily, and I think it's ok for now, but something to flag for follow up 
* May need refactor, see my comments on Part 1 in central server codebase: https://github.com/fle-internal/ka-lite-central/pull/190

the issue here is I need to pass in an org object to create a breadcrumb if we're on the central server and if the user clicked through from the org. In this case, we won't have a zone_id, just an org_id. I couldn't think of how to retrieve an org object without using the orm, hence the funky central-only import above.