does this need to check that the user is in the maintainers list? like:

    if not user or self.user.username not in users or user["access"] != 2: