Support accessing /api/ endpoints using jwt authentication

[wlach]

To support the internal server use case, @jezdez had the idea of using https://github.com/davesque/django-rest-framework-simplejwt to allow users to get a token which allows accessing the iodide api's with a known expiry (unlike the django session authentication, which randomly times out due to the vagaries of openidc).

The server-side implementation of this is likely to be very similar to the authtoken authentication I added in a4a8f58. Obviously the client side will also need to be reworked to use it, but I think we can get the server parts working standalone and test it, and then work on the client parts as a seperate step.

@rafrombrc @robhudson (or others) -- any interest in giving this a shot? I will be away this coming week but can review when I return.

[wlach]

It seems like fate would have me implement all of this.