Allow specifying an empty list of permissions for get_objects_for_user

This allows one to ask for all objects for which an user has any permission. In a way it mirrors `get_users_with_perms`.

In addition, I fixed how the final query is made. Instead of creating an in-memory list of all IDs and then passing it in, you can pass all IDs simply as a subquery. This both improves the query and also allows more complicated basic queries (I was getting an error that I cannot use OR for two queries with "extra"). Also, it works now with documents which do not have integers as primary keys (I have UUIDs and `int(v)` does not work).

Fixes #244.