@whit537: Actually, you can't. `self.username` refers to the currently logged in user, not the username specified in the url. Replacing `username` with `self.username ` will toggle `is_suspicious` of the currently logged in user, which is not what we want.