move auth logic into AuthFieldFile.can_view