IMO, I still think we need a 'is_staff' auth check here...