has_perm checks on individual objects

Some changes, such that `has_perm` behaves a little more in line with expectations. Now if you supply an `obj` argument, it will make sure that the supplied object is in the supplied container. If not, `has_perm` will report `False`, even if the user would have permissions to the object in a different container.