made standard django auth come before whitelisted auth