This is just the permission check that's in get_object().