Auth

This changes auth from ``is_staff`` to a more general permissions approach.