I added some documentation to clarify this, `AllowSelf` won't work here, because the `user` FK points to an `User` instance instead of an `UserProfile` (the model used is directly `UserProfile`)