List request

This does a few things:

- Do not provide a default of "show every model". Its 2 lines of code to change and not worth the security headache.
- Changes the API of `get_queryset` to take a request instead of an object. This is necessary to support things that span beyond user-based permissions. In Sprint.ly's case, user+product is the specific permission we want here, which isn't exposed without passing the full request, as it'll be in post data.