Fixed issue with invalid objects being returned

`get_objs_for_user` was previously not limiting the returned
objects to the specific model, so it would return all objects for
all models specified in the settings when called.  It also wasn't
limiting the scope to the specific permission, so this caused
any expected errors, none of which we had tests to cover.

There were also a few PEP8 fixes included in this.
Added a few more tests

Added some tests which run through a few different combinations
that users may encounter with `get_objs_for_user` and what the
expected results are.