new document: Django permissions

This is a first pass at documenting some consensus surrounding how to implement permissions in DRF-based API applications based on discussions from the Hopper group.