Create user registration over API

[mcab]

Closes #11.

Adds user registration / login / logout to the application.

[mcab]

This still needs to be worked on:

• [x] Modify routes to only include those that we need (https://github.com/sunscrapers/djoser/issues/179)
  • [x] Disable set_username/user-change-username (we technically don't use them, we'll be using email / social logins)
  • [x] Disable root/api-root
  • [x] Disable user-list
• [x] Refactor authentication to be in its own file (probably under /apps/api/auth.py)
• [ ] Test...
  • [ ] user-activate/user-activate-resend
  • [ ] password-reset/password-reset-confirm
  • [ ] user-confirm/user-detail
  • [ ] Multiple logins to the same account

Possibly need to create our own User model to start tracking / waiting for certain inputs.

[mcab]

Blocked by #27 at the moment.

[mcab]

Since the schema is technically in flux, we want to have an MVP without data from #27, so we can focus on recording and displaying the House data in multiple places. So, not blocking, but we will still need to do the other tasks above.

[mcab]

Disabling routes turned out to be pretty tricky.

The noted GH issue above let you include or exclude certain urls, but by using DefaultRouter from DRF, certain paths were expected to be there. Due to such, set_username would still be there even if the path was manually not included.

So, we had to create the paths from what was listed in the Djoser URL files. To generate the URL paths now, we couldn't rely on a DefaultRouter; that would include some extraneous paths (user-confim, user-detail) that we no longer needed. So, AuthView lists the specific named routes in urlpatterns for apps/api/auth.py, and generates the absolute URI from them based off of the reversed path, otherwise, we generate relative URLs.

Now, we can browse to /auth/ and see the possible options. It's possible we do not actually need this, or better yet, only include the endpoints that the current accessing user has permission to do, but that seems to be out of scope.

---

Testing has fallen out of scope for this PR; the methods happen to do what they're intended for (activate, password-reset), while some (user-confirm, user-detail) were aliased paths to other locations.