This matches the field name and simplifies the code somewhat

Unfortunately bootstrap-tagsinput does not have a configurable
delimiter so settle with ',' for now (no commas allowed in tags).

This allows the JavaScript to display the tags to work

I had originally thought the field could be called terms[free-tags] and
we could use this notation for any other taxonomy-related field. This
would be too difficult in Django so I've used the name tags as was
already in the template.

When the form is submitted, any existing free tags will be deleted
before the ones present in the form are added.

Ability to add multiple terms from the same taxonomy to an item.

It is now possible to add multiple terms to an item in the same
taxonomy via the REST API. Terms not already present in the database
will be created.

We got bad performance degrading as the number of terms increased.
Enabling django_debug_toolbar it was easy to see a bunch of queries
getting terms related to items duplicated as many times as items
in the system. Making the api view for listing items prefetch related
terms (and their taxonomies) removes these O(n) queries

The next hidden parameter in the form, which determines the redirect
following an update is set to the 'next' query parameter in the form.
If the query parameter does not exist, the HTTP_REFERER is used.
If neither exist, the user gets redirected to the dashboard.

Add the add item functionality. Also enforce a default value for item-type on forms. While the API allows for items without an item-type, the form's handling of it was inconsistant. Until we have a use case for items without an item type, a default is enforced.

Make the update button first in the code so that html5 browsers consider it the default button when pressing enter.

This is a temporary fix - we should fix this properly by getting
the serializer to format datetimes for us.

Disabling the API urls is a quick fix security measure.  Obviously we'd
want the api urls to exist -- with suitable authentication in a real
system. And it sucks to loose the ability to use the web interface to
the API that DRF provides during testing, so here I'm disabling only
if DEBUG=False