Turns out that Django's default permissions backend always returns
False when checking object-level permissions, even if the user does
have valid global permissions.