This is actually a Django-specific question, as the user and permission mechanisms are coded in django.contrib.auth. Take a look at the Using the Django authentication system guide for more info. Also, you can re-ask the question on the Django users mailing list.