fix #14: use django customized permissions for user permissions