Simplify permissions setup for API

We do explicit check for every write operation, so do not do any
permission check at REST framework level.
Signed-off-by: Michal Čihař <michal@cihar.com>

weblate/accounts/models.py

@@ -883,7 +883,6 @@ def create_groups(update):
     group, created = Group.objects.get_or_create(name='Users')
     if created or update:
         group.permissions.add(
-            Permission.objects.get(codename='change_translation'),
             Permission.objects.get(codename='upload_translation'),
             Permission.objects.get(codename='overwrite_translation'),
             Permission.objects.get(codename='save_translation'),
@@ -907,7 +906,6 @@ def create_groups(update):
         AutoGroup.objects.create(group=group, match='^.*$')
 
     owner_permissions = (
-        Permission.objects.get(codename='change_translation'),
         Permission.objects.get(codename='author_translation'),
         Permission.objects.get(codename='upload_translation'),
         Permission.objects.get(codename='overwrite_translation'),

weblate/settings_example.py

@@ -561,7 +561,7 @@ REST_FRAMEWORK = {
     # Use Django's standard `django.contrib.auth` permissions,
     # or allow read-only access for unauthenticated users.
     'DEFAULT_PERMISSION_CLASSES': [
-        'rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly'
+        'rest_framework.permissions.IsAuthenticatedOrReadOnly'
     ],
     'DEFAULT_AUTHENTICATION_CLASSES': (
         'rest_framework.authentication.TokenAuthentication',