added first public views - no check for access rights at the moment

lib/api/permissions.py

@@ -0,0 +1,11 @@
+from rest_framework import permissions
+
+
+class IsAuthorOrReadOnly(permissions.BasePermission):
+
+    def has_object_permission(self, request, view, obj):
+        # Read permissions are allowed to any request
+        if request.method in permissions.SAFE_METHODS:
+            return True
+
+        return obj.author == request.user or request.user.is_superuser