Define minimal authorization policy

[mcovalt]

Currently, views routed by Girder 4 are public unless explicitly protected by some authorization checks. This issue is a proposal to add some friction to the development process so that public views are discouraged in favor of views protected by some minimal policy.

One possible minimal policy is to require users be logged in to interact with the views. The friction could be provided by using the Django system check framework to introspect the application's URLconf and issue a warning if it encounters any of the following:

• Django function based view that is not wrapped with the login_required decorator
• Django class based view that does not inherit the LoginRequiredMixin
• Django REST Framework function based view that is not wrapped with the permissions_classes decorator specifying the IsAuthenticated permissions class.
• Django REST Framework class based view that does not include the the IsAuthenticated permissions class in the permissions_classes attribute array

This is not intended to define an authorization policy for all applications. Rather, it is intended to initialize applications with a slightly more conservative authorization policy rather than having none at all.