I meant for your idea to modify <code>@login_required</code>. If we're constantly checking users against the UserStanding table to see if they can access a page, I don't think that would be too expensive. It does feel a little hacky though.