Fix has_perms

For the individual object authorization checks, use ``bundle.obj`` and
ignore ``object_list``

Addresses #614