the commonware version of this middleware defaults to DENY, so that's why I had to override django's default which is ALLOW.