so it can be used to generate unsubscribe tokens

This is achieved by allowing access if settings.DEBUG is True and
settings.EDX_API_KEY is not set or None (which is true for dev.py)

The new API uses Django REST Framework. For now, it is designed specifically
to support the use cases required by the forum digest notifier (not yet built),
with a goal of making it more generally useful over time.