Shouldn't is_staff be False (well, really shouldn't it check the current user)?

And for authenticated, it seems strange to hard-code to True.