So, since django doesn't seem to ensure that it only has one instance of user for any particular userId, we cannot cache the groups on the user object. To me that implies that the cache will need to be local to roles.py or use memcache. I presume memcache is preferable (although I'll leave it to config to decide precise mechanism).