In Django, .is_superuser gives a user all permissions, but you *still* need to set .is_staff to access everything.