Closes https://bugs.ligo.org/redmine/issues/933

GraceQueryField used to return a Q() instance for cleaned 'query'
field.  Unfortunately, bad queries were not always identified until
the Q() instance was used to do a query.  If the filter() is done
while cleaning the data, this error case can be identified earlier
and in what is likely a more appropriate place.  Luckily, Django
querysets are lazy, so only the SQL query is build -- nothing hits
the database itself until the data is required.

https://bugs.ligo.org/redmine/issues/732

https://bugs.ligo.org/redmine/issues/794

Query on "Submitter" Broken.

REST API won't allow label creation.
PUT's to /api/events/GRACEID/labels/LABELNAME fails

To accomodate the fact that our Apache can't do Shibboleth *and* X.509
auth on the same URL and we want both kinds of auth available for the API.