Before this commit only the MultipleObjectAPIView would apply a
filter_backend, leaving the SingleObjectAPIView to return objects you
might otherwise expect to have been filtered out.

It's worth mentioning that when a SingleObjectAPIView makes a request
for an object that should be excluded, a 404 is the expected result.