A loophole allowed LVC users who are also LV-EM members to access
the page for creating/managing passwords for basic auth access
to the API.  This commit fixes that by also checking for the
absence of LVC membership before allowing access to the page.

Updated from Django 1.11.5 to Django 1.11.14. Updated 3rd party
packages so that all of them have version requirements in
requirements.txt.  Also updated most of these packages to use the
newest versions.  A specific update to the twilio package required
some changes for how we determine the 'from' phone number. Also
alphabetized the packages in this file.  Finally, added the very
useful django-silk debugger/profiler.

django-extensions was just in the test settings before (i.e., not
deployed on production), but it is pretty nice and useful, so we
are moving it into the base settings so that it can be used
everywhere!

Updated event static file serving to use X-Sendfile with Apache.
This is faster, more efficient, and seems to resolve the issue
with FITS file downloads from the web browser:
https://bugs.ligo.org/redmine/issues/6194

Added a utility method for creating versioned files from
either a string or an in-memory file.

Properly handling content_type for serving files with
X-Sendfile.

Adding middleware which checks the client version (for everything
under /api*) by using the User-Agent header. Obviously requires the
client to set the header appropriately as well.  Allows access
when the header is set but 'gracedb-client' is not found in it
since browsers have to access the web browsable API.

Added requirement that event.search is not None before checking
that event.search.name is MDC.  Fixes a bug which occurred when a user
tried to get an event by specifying 'M1234' when the event was not
an MDC event (and didn't have a search associated with it).

Missed one case where 'tag' should have been 'tags' in
58efeab3. Also updated same thing
in documentation.

Fixing issue where some float fields were left as strings in
LVAlert JSONs and response JSONs.  Occurred because they were
extracted as strings from files and saving the event did not
fix the attribute types without refreshing from the database.
See https://git.ligo.org/lscsoft/gracedb/issues/10.

simplejson package is used to properly serialize Decimal objects
(like gpstime) when converting from a dictionary to a json.

Event time nanoseconds did not include leading zeros when printed
in event.log (since 2010!!). See
https://git.ligo.org/lscsoft/gracedb/issues/9.

Unsure why messaging app was not enabled; it's needed for
posting flash messages about contacts and notifications.

Javascript time zone selectors assumed the server time zone to be
America/Chicago, which we changed in
ab72e160, so we fixed that here.
Also fixed assumptions that LLO is in the same time zone as the
server.

Fixed a bug in gracedb/templates/gracedb/event_detail_script.js
which caused event logs to not render properly since the code was
trying to access a div which didn't exist.