Basic and extendable API for patients

A simple API using django-rest-framework to full-fill #3.

# What's changed:
* Add token authentication
* Add a patient serializer
* Add a patient API viewset
* Add URL endpoints `api` and and `api/patients`
* Add search on patients ex: `api/patients?search=Jane`
* Add filter on patients ex: `api/patients?alive=True`
* Some basic documentation in README.md in `api/`
* Some basic tests

# What's next
* Wait on feedback, add more filters, more search parameters?
Not `POST`ing the ID is just a safety net to avoid ID-collision. It forces the server to be the sole authority on the matter.
It's usually part of the role of the DB to provide the IDs.