make DomainAdminAuthentication properly honor digest auth

small refactor of permissions scheme to support this.
Merge pull request #3770 from dimagi/domain-admin-digest-apis

make DomainAdminAuthentication properly honor digest auth