Fix incorrect 401 vs 403 response, if lazy authentication has not taken place.
Add object permissions tests.
Make use o issubclass instead of isinstance (fix issue #645)

Because __mro__ is a list of classes and not instances.
DictWithMetadata.__getstate__ was never called

Signed-off-by: Fernando Rocha <fernandogrd@gmail.com>
Merge pull request #651 from fernandogrd/master

DictWithMetadata.__getstate__ was never called (Fix for 645)
New style object-level permission checks
Tidy up internal view permission checking logic.

Also document correctly - these methods are now public and will fall
under the deprecation policy from now on.
Use `many=True` for serializers.
Notes on object-level permissions.
Drop `six` module from coverage.
Notes on object-level permissions.
Update release notes
Document serializing querysets
Raise warnings on implicit many serialization
Raise warnings if 'request' not in context for hyperlinked fields.
Docs on serializer context.
Remove deprecated APIs from tests
Notes on explicit hyperlink relations behavior
Add deprecation policy to release notes.
Remove changelog from README
Drop issue management section