Add OAuth login

[rgossiaux]

As discussed in #724 this is probably the right way to do auth for things like a chrome extension or a bot or anything else that wants to interact with cardboard via API.

There are existing packages out there that should make this pretty easy, like https://django-oauth-toolkit.readthedocs.io/en/latest/rest-framework/getting_started.html