add `needs_author`, `requires_express_permission_for_publication` and `url`

update LicenseSerializer and license fixture

- replace LicenseType with License model, update fixture, serializers, views, and urls

Closes: #167

Closes: #171

Closes #157

Closes: #155

Closes: #155

- The user or username is no longer "injected" in the view sets
- The user and username are obtained in the serializers from requests

- Replace ImageField with ForeignKey reference to Image
- Update `program/show.json` fixture
- Update serializer to refer to Image and allow null

The serializer would return an invalid format for the image.ppoi field
causing errors on save through the API even if the API consumer didn’t
modify the ppoi field value.

Apart from that the current implementation caused an internal server
error instead of rejecting invalid formats on save.

Any frontend will need the dimensions of the supplied thumbnails
to select the appropriate thumbnail in different rendering contexts.

Apart from that the thumbnail name is not that helpful, as we need
the full thumbnail URL to be able to display it.

- remove ThumbnailsMixin and thumbnails fields,
- remove image_* fields and theis usage,
- use utils.delete_links function

- remove ThumbnailsMixin and thumbnails fields,
- remove image_* fields and theis usage,
- use utils.delete_links function

- remove ThumbnailsMixin and thumbnails fields,
- remove image_* fields and theis usage,
- introduce utils.delete_links function

Use it with `HostSerializer`, `NoteSerializer` and `ShowSerializer`

- reorder explicitily named fields,
- define `{created,updated}_{at,by}` as read-only-fields