Restricting access to class-based views