Fixed a bug where if the content type of the permission requested was
different to that of the requesting scope, we would get a 404 because
the item's path would be inferred as that of the requesting type. This
really needs to be made more explicit and less magical.
Various fixes and form cleanups