crucialfelix/django-ajax-selects — comment on commit 2190a31a1f6a471737e8fa9fb574026ef93a3374
File:  line 0
By crucialfelix:

all they have to do is implement check_auth method.

that's less complicated then telling them to choose a different mixin class just to get that one method implemented differently.

at the moment (as in for the past several years) anybody could get any data they want out of the app by just getting the URLs. that's not a good default and my docs that told people to implement their own security didn't help to convince people.