DB-less Django authorization