fix(controller): honor permissions on app-related views

From the [django-restframework docs](http://www.django-rest-framework.org/api-guide/permissions#object-level-permissions):
> If you're writing your own views and want to enforce object level permissions,
> or if you override the get_object method on a generic view, then you'll need
> to explicitly call the .check_object_permissions(request, obj) method on the
> view at the point at which you've retrieved the object.

Fixes #1576.