Use $_product object instead of undefined $product_id for downloadable permissions. Fixes #4095