This is not sufficient; anyone can spoof any value in request.POST.

You need to compare to `request.user`, which is the user that corresponds to the session cookie supplied in the request (if any).