Please use user.is_superuser rather than staff. Staff means 'can access the admin panel', superuser means 'has all permissions. We don't _currently_ grant permission-based access to the admin panel, but we might in the future, and these checks should remain consistent. We're already using superuser in other places where we grant this sort of access, like with privacy: https://github.com/mozilla/mozillians/blob/master/mozillians/users/models.py#L375