Decouple base flow from django auth permissions