on_delete=models.PROTECT as sane default