Manually perform permisssion lookups on FeedShelfView to ensure that users with object-level permissions appropriately pass validation (necessary for bug 1100554).

This is necessary because DRF will never run object-level permissions checks (i.e. has_object_permission) if the user fails the top-level checks (i.e. has_permission). There are valid use cases here where a user could pass has_object_permission but not has_permission.

To bypass this, we perform the validation checks in the viewset rather than in permission classes. This is unfortunate, but necessary.

r? @ngokevin @diox @robhudson
It'd be awesome if you could fix this now rather than whoever picks up the 'Upgrade to Django 1.x' bug in the future and has little context of what needs to happen to get rid of `request.REQUEST`.