UK: make use of pk keyword only for api access
UK: add DjangoObjectPermissionsFilter