we should change this to `user.has_perm('users.add_userban')`