Switch to towel.mt.AccessDecorator

@login_required is not sufficient