Authorize all API requests

[jrjohnson]

Symfony role voters seem to be the way to go.

For each domain object we will create a role voter which will decide if a user can 'view', 'edit', or 'delete' the object. This allows us to customize the logic for a Course vs a MeshTerm.

Each entity accessible from a controller will need a separate voter. I think we will also need to check the relationships for each entity before returning the final API response, but I'm not sure how to do that yet.

[jrjohnson]

Duplicate of #923