Follow the django strategy of non object permission

See: https://code.djangoproject.com/wiki/RowLevelPermissions