Make sure lizard-security also checks objects reached via a foreign key

All that this pull request does is set 'use_for_related_fields=True' on both managers, but that has some feet in the earth.