Build out the rest of the CRUD operations for headless api.

[serundeputy]

Right now the headless module is a read only API.

We should build out the rest of the CRUD operations into headless.

We should introduce some headless specific permissions in order to lock down POST endpoints to specific user/administrator sets.

• We may need to breakout a v1 and v2 include file. This would allow the current read only endpoints to be managed as they are now by checking off the entities you want to expose in the headless settings page. Whereas the v2 endpoints would respect the settings page and the new permission set.

• We need to build out the POST endpoints

• We'll want an authentication mechanism for the POST endpoints