flake8 frowns upon the use of binary operators right before a linebreak

* /media and /static routes are now authentication-free
* add documentation why redirects should or should not happen

Images must be returned as object with alt property and multiple sources
for different screen sizes.

Add corsheaders app so that responses delivered for /api routes contain
proper CORS headers required by clients running in browsers constrained
by same-origin policies.

Note: /media/ routes are configured in the default configuration because
the development web server should immitate the behaviour of a production
web server. However CORS headers will not be present on a production
server if not configured separately, because the /media/ path is
handled by the static file serving mechanism of common web servers.

The REST API will be consumed by clients that don’t necessarily know the
backend host, because API access is proxied. URLs should therefore be
absolute in all cases.

Pagination settings change the default response format of the API for
collection GET requests, so we want a proper default for all instances.
Otherwise people will complain that the lohrothek frontend (thekno)
"doesn’t work" :).

This reverts commit 999dff65.

This reverts commit 38deac71.

Add CI tests

See merge request !2

this adds generic make targets for installing dependencies and
basic application configuration in disposable environments like
docker containers.

warum auch immer er das wiederholt macht?!