Require auth by default in Django api

[toswe]

Currently auth is checked per view by:

    permission_classes = (IsAuthenticated,)

All endpoints should be protected by default.