Require a logged-in user for uploads

[brianhelba]

This could be implemented by simply adding @permission_classes([IsAuthenticated]) to each view function.

However, it may be better to not enforce authentication in S3FF, and give downstreams the ability to veto uploads on a per-request basis.

[zachmullen]

If we're going to leave this up to downstreams, we need to call out how to do it in the docs, because it'll be the most common case. A setting to control it would also be nice.