switching to use django authorization, refs #1