Permission checks in views should always evaluate the concrete model for an instance

[jeremystretch]

Proposed Changes

Currently, we always evaluate the model class of an instance when determining applicable permissions. Instead, we should we query for permissions assigned to its concrete model (i.e. instance._meta.concrete_model). There are a few places where this adjustment needs to be made.

Justification

Referencing the model directly inhibits the use of proxy models in established conventions. For instance, we want to be table to evaluate permissions using a UserToken instance to get permissions for its concrete Token model.

[jeremystretch]

Really we should be using get_permission_for_model() everywhere, which has already been updated to do this.