has_perm checks on individual objects

Some changes, such that `has_perm` behaves a little more in line with expectations. Now if you supply an `obj` argument, it will make sure that the supplied object is in the supplied container. If not, `has_perm` will report `False`, even if the user would have permissions to the object in a different container.
What types of exception are we expecting here? Not every possible exception means the user is unauthorized, and I think it would be more useful to us not to suppress unexpected exceptions.