I would suggest adding this in a new subsection (rather than a note box) above this section: https://docs.djangoproject.com/en/dev/topics/auth/default/#authentication-in-web-requests
 
Could expand the text a bit to note that reloading the user isn't required in most cases since each request reloads the user? It's only required if you're adding permissions dynamically. The code snippet in the ticket would be useful here.