refactored to be more Django-esque, todo: allow non-user linked actions