Don't fetch the whole object when checking permissions

[stsewd]

This also checks for is_superuser first

Kind of related to #5460

[stsewd]

Ok, so we realized that with this change, we'll always hit the db, so #5460 is enough

[davidfischer]

Prefetching objects in Django with prefetch_related or prefetch_related_objects does an optimization such that project.users.all() won't hit the database. However, project.users.filter(pk=user.pk).exists() (or any filter query) will always hit the database. I think this confusion though means that AdminPermissionBase probably warrants a comment.