Manually perform permisssion lookups on FeedShelfView to ensure that users with object-level permissions appropriately pass validation (necessary for bug 1100554).

This is necessary because DRF will never run object-level permissions checks (i.e. has_object_permission) if the user fails the top-level checks (i.e. has_permission). There are valid use cases here where a user could pass has_object_permission but not has_permission.

To bypass this, we perform the validation checks in the viewset rather than in permission classes. This is unfortunate, but necessary.

r? @ngokevin @diox @robhudson
As of Django 1.7, the property `REQUEST` is deprecated and will be removed in Django 1.9. Does it not matter where the data comes from here?