'Return True if the user can do action to the pk, False if not.
User may be AnonymousUser if no auth hooked up/they\'re not logged in.
Action is one of "create", "delete", "update".'

def has_permission(self, user, action, pk):

    raise NotImplementedError()
