Restricting access to user-uploaded files in Django | Hacker News Reader