eligible-users api - restrict to global admins and project admins

[ethanstrominger]

Dependency

• eligible-users end point - define rows returned #394

Overview

Ensure only valid users can use the API

API specification

/eligibile-users/

Action Items

• permissions.py (& views.py): UserEligiblePermission
  • Validate project id.
  • views.py: Add as a permission to UserEligibleView
  • Check if user is a global admin or project admin. If not, return error.
  • If not a global admin, check that project admin is assigned to the specified project. If not, return errror.