I think my code and the intention with it is cryptic. That's why it gets you confused. I could do with some help from you to untangle that. 

Basically, the intention is this; the `UnredactedCrash` model should only be usable if you have those two permissions. And if you have `view_pii` it doesn't matter what `API_WHITELIST` does at all because of [this](https://github.com/mozilla/socorro/commit/53c6653b694d232cc99509e0dd7026e10e820bec#diff-423086368fa25b25d14d1acfa265c6a3R229) Basically, it doesn't even get to the `API_WHITELIST` stuff. 

The assumption is that `unredacted = processed + sensitive stuff`. So, if you don't have `view_pii` you won't get anything here you don't already get from `ProcessedCrash`. And if you have `view_pii` there's no point writing down a whitelist. 

So, does that make sense? I think that's the correct logic but there's something confusing about it. Perhaps I just need to express what I just expressed here into a comment under that class.