Needs to be `request.is_admin` instead of `request.user.is_authenticated() and request.user.is_superuser` here.
(The first includes teachers as well, even though they're not superusers)