should only allow stuff we're doing with django which is only post right?