A simple way to define complex permissions for django-rest-framework