diff --git a/dusken/api/member.py b/dusken/api/member.py
index 5a3bce2..40f3a3b 100644
--- a/dusken/api/member.py
+++ b/dusken/api/member.py
@@ -165,8 +165,8 @@ class MemberCreateResource(ModelResource):
         detail_allowed_methods = []
         default_format = "application/json"
         queryset = Member.objects.all()
-        authentication = OAuth20Authentication() # anyone
-        authorization = Authorization() # can do what they want with anything
+        authentication = OAuth20Authentication()  # Who are you?
+        authorization = MyDjangoAuthorization() # What are you allowed to do?
         always_return_data = True
         excludes = [ 'date_joined', 'password', 'is_active', 'is_staff', 'is_superuser', 'last_login' ]
         validation = CleanedDataFormValidation(form_class=MemberCreateForm)