Cloning QuerySets

I didn't notice before that the QuerySet objects have internal state.
I assumed that each time you applied a filter, a new QuerySet object
was created, but this isn't the case.  So when calling has_read_permission
it is necessary to clone the queryset to avoid side-effects.
Merge branch 'richer_authorization'