Check the user is staff, not is_authenticated