Fix request view permissions [PD-851]

The various sublcasses of BaseModel have different fields, so will need to be overridden manually. I'm okay with the relation I'm checking for PurchasedJob, but I'm less pleased with OfflinePurchase.

To get to company, I see the following options:
* self.products.all()[0].owner
* self.invoice.owner (but this may not be present)
* self.created_by.company (method used here)

Suggestions on preferred method?

All tests pass.