title: See only owner's data in ListAPIView
body: <p>I have a view deriving from ListAPIView, with the following permissions:</p>
  
  <p><code>permission_classes = (permissions.IsAuthenticated, IsOwnerOrSuperuser, )</code></p>
  
  <p>IsOwnerOrSuperuse is defined as such:</p>
  
  <pre><code>class IsOwnerOrSuperuser(permissions.BasePermission):
  
  def has_object_permission(self, request, view, obj):
      return obj.user == request.user or request.user.is_superuser
  </code></pre>
  
  <p>(which is very similar to the tutorial)</p>
  
  <p>Now, when a normal user queries my view, it can see everyone's objects. Isn't the permission applied to every single object in the list? How can I enforce this type of behaviour with minimal overhead?</p>
  
  <p>Thanks</p>