Permissions for timetables are not checked properly

If LessonEvent.get_objects gets a request, we should only return things the user is allowed to see depending on the permissions.