Set up allow/deny rules for a Django app via settings.py