Add server-side user authorization

[charlesjhill]

At this point in time, our API endpoints remain open to whomever is interested and all verification happens on the client-side. This is vulnerable to really simple exploits that would allow more tech-savvy members of the band to do whatever they want. This should be rectified by adding server-side authorization of users to all our views.

To accomplish this, we can add permission classes to our API Views; the rough idea though is to create some custom permissions that check if a user has the is_student flag set to false or has the is_staff flag set to true, and if so allows access.