We should turn this "non-staff gets a 404" logic into a decorator.