diff --git a/aleksis/core/menus.py b/aleksis/core/menus.py
index bc68f034dfe665ea7e0447925075aec5bcc887cb..d518b15e3f8693446dd7a9367e5f86b4083f0af9 100644
--- a/aleksis/core/menus.py
+++ b/aleksis/core/menus.py
@@ -98,7 +98,7 @@ MENUS = {
                     "validators": [
                         (
                             "aleksis.core.util.predicates.permission_validator",
-                            "core.view_announcements",
+                            "core.view_announcements_rule",
                         ),
                     ],
                 },
@@ -109,7 +109,7 @@ MENUS = {
                     "validators": [
                         (
                             "aleksis.core.util.predicates.permission_validator",
-                            "core.view_schoolterm",
+                            "core.view_schoolterm_rule",
                         ),
                     ],
                 },
@@ -120,7 +120,7 @@ MENUS = {
                     "validators": [
                         (
                             "aleksis.core.util.predicates.permission_validator",
-                            "core.view_dashboardwidget",
+                            "core.view_dashboardwidget_rule",
                         ),
                     ],
                 },
@@ -129,7 +129,10 @@ MENUS = {
                     "url": "data_management",
                     "icon": "view_list",
                     "validators": [
-                        ("aleksis.core.util.predicates.permission_validator", "core.manage_data"),
+                        (
+                            "aleksis.core.util.predicates.permission_validator",
+                            "core.manage_data_rule",
+                        ),
                     ],
                 },
                 {
@@ -139,7 +142,7 @@ MENUS = {
                     "validators": [
                         (
                             "aleksis.core.util.predicates.permission_validator",
-                            "core.view_system_status",
+                            "core.view_system_status_rule",
                         ),
                     ],
                 },
@@ -148,7 +151,10 @@ MENUS = {
                     "url": "impersonate-list",
                     "icon": "people",
                     "validators": [
-                        ("aleksis.core.util.predicates.permission_validator", "core.impersonate"),
+                        (
+                            "aleksis.core.util.predicates.permission_validator",
+                            "core.impersonate_rule",
+                        ),
                     ],
                 },
                 {
@@ -158,7 +164,7 @@ MENUS = {
                     "validators": [
                         (
                             "aleksis.core.util.predicates.permission_validator",
-                            "core.change_site_preferences",
+                            "core.change_site_preferences_rule",
                         ),
                     ],
                 },
@@ -181,7 +187,7 @@ MENUS = {
                     "validators": [
                         (
                             "aleksis.core.util.predicates.permission_validator",
-                            "core.list_oauth_applications",
+                            "core.list_oauth_applications_rule",
                         ),
                     ],
                 },
@@ -193,7 +199,7 @@ MENUS = {
             "icon": "people",
             "root": True,
             "validators": [
-                ("aleksis.core.util.predicates.permission_validator", "core.view_people_menu")
+                ("aleksis.core.util.predicates.permission_validator", "core.view_people_menu_rule")
             ],
             "submenu": [
                 {
@@ -201,7 +207,10 @@ MENUS = {
                     "url": "persons",
                     "icon": "person",
                     "validators": [
-                        ("aleksis.core.util.predicates.permission_validator", "core.view_persons")
+                        (
+                            "aleksis.core.util.predicates.permission_validator",
+                            "core.view_persons_rule",
+                        )
                     ],
                 },
                 {
@@ -209,7 +218,10 @@ MENUS = {
                     "url": "groups",
                     "icon": "group",
                     "validators": [
-                        ("aleksis.core.util.predicates.permission_validator", "core.view_groups")
+                        (
+                            "aleksis.core.util.predicates.permission_validator",
+                            "core.view_groups_rule",
+                        )
                     ],
                 },
                 {
@@ -219,7 +231,7 @@ MENUS = {
                     "validators": [
                         (
                             "aleksis.core.util.predicates.permission_validator",
-                            "core.view_grouptypes",
+                            "core.view_grouptypes_rule",
                         )
                     ],
                 },
@@ -230,7 +242,7 @@ MENUS = {
                     "validators": [
                         (
                             "aleksis.core.util.predicates.permission_validator",
-                            "core.link_persons_accounts",
+                            "core.link_persons_accounts_rule",
                         )
                     ],
                 },
@@ -241,7 +253,7 @@ MENUS = {
                     "validators": [
                         (
                             "aleksis.core.util.predicates.permission_validator",
-                            "core.assign_child_groups_to_groups",
+                            "core.assign_child_groups_to_groups_rule",
                         )
                     ],
                 },
@@ -252,7 +264,7 @@ MENUS = {
                     "validators": [
                         (
                             "aleksis.core.util.predicates.permission_validator",
-                            "core.view_additionalfields",
+                            "core.view_additionalfields_rule",
                         )
                     ],
                 },
@@ -266,7 +278,7 @@ MENUS = {
             "validators": [
                 (
                     "aleksis.core.util.predicates.permission_validator",
-                    "core.assign_child_groups_to_groups",
+                    "core.assign_child_groups_to_groups_rule",
                 )
             ],
         },
diff --git a/aleksis/core/rules.py b/aleksis/core/rules.py
index 9c05d1cabdb2b627826516742922c76e0ec13fce..d6b823064b72a0262c85a001f71a1941e42ec705 100644
--- a/aleksis/core/rules.py
+++ b/aleksis/core/rules.py
@@ -17,32 +17,32 @@ rules.add_perm("core", rules.always_allow)
 
 # View dashboard
 view_dashboard_predicate = is_site_preference_set("general", "anonymous_dashboard") | has_person
-rules.add_perm("core.view_dashboard", view_dashboard_predicate)
+rules.add_perm("core.view_dashboard_rule", view_dashboard_predicate)
 
 # View notifications
-rules.add_perm("core.view_notifications", has_person)
+rules.add_perm("core.view_notifications_rule", has_person)
 
 # Use search
 search_predicate = has_person & has_global_perm("core.search")
-rules.add_perm("core.search", search_predicate)
+rules.add_perm("core.search_rule", search_predicate)
 
 # View persons
 view_persons_predicate = has_person & (
-    has_global_perm("core.view_person") | has_any_object("core.view_person", Person)
+    has_global_perm("core.view_person") | has_any_object("core.view_person_rule", Person)
 )
-rules.add_perm("core.view_persons", view_persons_predicate)
+rules.add_perm("core.view_persons_rule", view_persons_predicate)
 
 # View person
 view_person_predicate = has_person & (
     has_global_perm("core.view_person") | has_object_perm("core.view_person") | is_current_person
 )
-rules.add_perm("core.view_person", view_person_predicate)
+rules.add_perm("core.view_person_rule", view_person_predicate)
 
 # View person address
 view_address_predicate = has_person & (
     has_global_perm("core.view_address") | has_object_perm("core.view_address") | is_current_person
 )
-rules.add_perm("core.view_address", view_address_predicate)
+rules.add_perm("core.view_address_rule", view_address_predicate)
 
 # View person contact details
 view_contact_details_predicate = has_person & (
@@ -50,13 +50,13 @@ view_contact_details_predicate = has_person & (
     | has_object_perm("core.view_contact_details")
     | is_current_person
 )
-rules.add_perm("core.view_contact_details", view_contact_details_predicate)
+rules.add_perm("core.view_contact_details_rule", view_contact_details_predicate)
 
 # View person photo
 view_photo_predicate = has_person & (
     has_global_perm("core.view_photo") | has_object_perm("core.view_photo") | is_current_person
 )
-rules.add_perm("core.view_photo", view_photo_predicate)
+rules.add_perm("core.view_photo_rule", view_photo_predicate)
 
 # View persons groups
 view_groups_predicate = has_person & (
@@ -64,7 +64,7 @@ view_groups_predicate = has_person & (
     | has_object_perm("core.view_person_groups")
     | is_current_person
 )
-rules.add_perm("core.view_person_groups", view_groups_predicate)
+rules.add_perm("core.view_person_groups_rule", view_groups_predicate)
 
 # Edit person
 edit_person_predicate = has_person & (
@@ -72,91 +72,91 @@ edit_person_predicate = has_person & (
     | has_object_perm("core.change_person")
     | is_current_person & is_site_preference_set("account", "editable_fields_person")
 )
-rules.add_perm("core.edit_person", edit_person_predicate)
+rules.add_perm("core.edit_person_rule", edit_person_predicate)
 
 # Delete person
 delete_person_predicate = has_person & (
     has_global_perm("core.delete_person") | has_object_perm("core.delete_person")
 )
-rules.add_perm("core.delete_person", delete_person_predicate)
+rules.add_perm("core.delete_person_rule", delete_person_predicate)
 
 # Link persons with accounts
 link_persons_accounts_predicate = has_person & has_global_perm("core.link_persons_accounts")
-rules.add_perm("core.link_persons_accounts", link_persons_accounts_predicate)
+rules.add_perm("core.link_persons_accounts_rule", link_persons_accounts_predicate)
 
 # View groups
 view_groups_predicate = has_person & (
     has_global_perm("core.view_group") | has_any_object("core.view_group", Group)
 )
-rules.add_perm("core.view_groups", view_groups_predicate)
+rules.add_perm("core.view_groups_rule", view_groups_predicate)
 
 # View group
 view_group_predicate = has_person & (
     has_global_perm("core.view_group") | has_object_perm("core.view_group")
 )
-rules.add_perm("core.view_group", view_group_predicate)
+rules.add_perm("core.view_group_rule", view_group_predicate)
 
 # Edit group
 edit_group_predicate = has_person & (
     has_global_perm("core.change_group") | has_object_perm("core.change_group")
 )
-rules.add_perm("core.edit_group", edit_group_predicate)
+rules.add_perm("core.edit_group_rule", edit_group_predicate)
 
 # Delete group
 delete_group_predicate = has_person & (
     has_global_perm("core.delete_group") | has_object_perm("core.delete_group")
 )
-rules.add_perm("core.delete_group", delete_group_predicate)
+rules.add_perm("core.delete_group_rule", delete_group_predicate)
 
 # Assign child groups to groups
 assign_child_groups_to_groups_predicate = has_person & has_global_perm(
     "core.assign_child_groups_to_groups"
 )
-rules.add_perm("core.assign_child_groups_to_groups", assign_child_groups_to_groups_predicate)
+rules.add_perm("core.assign_child_groups_to_groups_rule", assign_child_groups_to_groups_predicate)
 
 # Edit school information
 edit_school_information_predicate = has_person & has_global_perm("core.change_school")
-rules.add_perm("core.edit_school_information", edit_school_information_predicate)
+rules.add_perm("core.edit_school_information_rule", edit_school_information_predicate)
 
 # Manage data
 manage_data_predicate = has_person & has_global_perm("core.manage_data")
-rules.add_perm("core.manage_data", manage_data_predicate)
+rules.add_perm("core.manage_data_rule", manage_data_predicate)
 
 # Mark notification as read
 mark_notification_as_read_predicate = has_person & is_notification_recipient
-rules.add_perm("core.mark_notification_as_read", mark_notification_as_read_predicate)
+rules.add_perm("core.mark_notification_as_read_rule", mark_notification_as_read_predicate)
 
 # View announcements
 view_announcements_predicate = has_person & (
     has_global_perm("core.view_announcement")
     | has_any_object("core.view_announcement", Announcement)
 )
-rules.add_perm("core.view_announcements", view_announcements_predicate)
+rules.add_perm("core.view_announcements_rule", view_announcements_predicate)
 
 # Create or edit announcement
 create_or_edit_announcement_predicate = has_person & (
     has_global_perm("core.add_announcement")
     & (has_global_perm("core.change_announcement") | has_object_perm("core.change_announcement"))
 )
-rules.add_perm("core.create_or_edit_announcement", create_or_edit_announcement_predicate)
+rules.add_perm("core.create_or_edit_announcement_rule", create_or_edit_announcement_predicate)
 
 # Delete announcement
 delete_announcement_predicate = has_person & (
     has_global_perm("core.delete_announcement") | has_object_perm("core.delete_announcement")
 )
-rules.add_perm("core.delete_announcement", delete_announcement_predicate)
+rules.add_perm("core.delete_announcement_rule", delete_announcement_predicate)
 
 # Use impersonate
 impersonate_predicate = has_person & has_global_perm("core.impersonate")
-rules.add_perm("core.impersonate", impersonate_predicate)
+rules.add_perm("core.impersonate_rule", impersonate_predicate)
 
 # View system status
 view_system_status_predicate = has_person & has_global_perm("core.view_system_status")
-rules.add_perm("core.view_system_status", view_system_status_predicate)
+rules.add_perm("core.view_system_status_rule", view_system_status_predicate)
 
 # View people menu (persons + objects)
 rules.add_perm(
-    "core.view_people_menu",
+    "core.view_people_menu_rule",
     has_person
     & (
         view_persons_predicate
@@ -172,14 +172,14 @@ view_personal_details_predicate = has_person & (
     | has_object_perm("core.view_personal_details")
     | is_current_person
 )
-rules.add_perm("core.view_personal_details", view_personal_details_predicate)
+rules.add_perm("core.view_personal_details_rule", view_personal_details_predicate)
 
 # Change site preferences
 change_site_preferences = has_person & (
     has_global_perm("core.change_site_preferences")
     | has_object_perm("core.change_site_preferences")
 )
-rules.add_perm("core.change_site_preferences", change_site_preferences)
+rules.add_perm("core.change_site_preferences_rule", change_site_preferences)
 
 # Change person preferences
 change_person_preferences = has_person & (
@@ -187,7 +187,7 @@ change_person_preferences = has_person & (
     | has_object_perm("core.change_person_preferences")
     | is_current_person
 )
-rules.add_perm("core.change_person_preferences", change_person_preferences)
+rules.add_perm("core.change_person_preferences_rule", change_person_preferences)
 
 # Change group preferences
 change_group_preferences = has_person & (
@@ -195,81 +195,81 @@ change_group_preferences = has_person & (
     | has_object_perm("core.change_group_preferences")
     | is_group_owner
 )
-rules.add_perm("core.change_group_preferences", change_group_preferences)
+rules.add_perm("core.change_group_preferences_rule", change_group_preferences)
 
 
 # Edit additional field
 change_additional_field_predicate = has_person & (
     has_global_perm("core.change_additionalfield") | has_object_perm("core.change_additionalfield")
 )
-rules.add_perm("core.change_additionalfield", change_additional_field_predicate)
+rules.add_perm("core.change_additionalfield_rule", change_additional_field_predicate)
 
 # Edit additional field
 create_additional_field_predicate = has_person & (
     has_global_perm("core.create_additionalfield") | has_object_perm("core.create_additionalfield")
 )
-rules.add_perm("core.create_additionalfield", create_additional_field_predicate)
+rules.add_perm("core.create_additionalfield_rule", create_additional_field_predicate)
 
 
 # Delete additional field
 delete_additional_field_predicate = has_person & (
     has_global_perm("core.delete_additionalfield") | has_object_perm("core.delete_additionalfield")
 )
-rules.add_perm("core.delete_additionalfield", delete_additional_field_predicate)
+rules.add_perm("core.delete_additionalfield_rule", delete_additional_field_predicate)
 
 # View additional fields
 view_additional_fields_predicate = has_person & (
     has_global_perm("core.view_additionalfield")
     | has_any_object("core.view_additionalfield", AdditionalField)
 )
-rules.add_perm("core.view_additionalfields", view_additional_fields_predicate)
+rules.add_perm("core.view_additionalfields_rule", view_additional_fields_predicate)
 
 # Edit group type
 change_group_type_predicate = has_person & (
     has_global_perm("core.change_grouptype") | has_object_perm("core.change_grouptype")
 )
-rules.add_perm("core.edit_grouptype", change_group_type_predicate)
+rules.add_perm("core.edit_grouptype_rule", change_group_type_predicate)
 
 # Create group type
 create_group_type_predicate = has_person & (
     has_global_perm("core.create_grouptype") | has_object_perm("core.change_grouptype")
 )
-rules.add_perm("core.create_grouptype", create_group_type_predicate)
+rules.add_perm("core.create_grouptype_rule", create_group_type_predicate)
 
 
 # Delete group type
 delete_group_type_predicate = has_person & (
     has_global_perm("core.delete_grouptype") | has_object_perm("core.delete_grouptype")
 )
-rules.add_perm("core.delete_grouptype", delete_group_type_predicate)
+rules.add_perm("core.delete_grouptype_rule", delete_group_type_predicate)
 
 # View group types
 view_group_types_predicate = has_person & (
     has_global_perm("core.view_grouptype") | has_any_object("core.view_grouptype", GroupType)
 )
-rules.add_perm("core.view_grouptypes", view_group_types_predicate)
+rules.add_perm("core.view_grouptypes_rule", view_group_types_predicate)
 
 # Create person
 create_person_predicate = has_person & (
     has_global_perm("core.create_person") | has_object_perm("core.create_person")
 )
-rules.add_perm("core.create_person", create_person_predicate)
+rules.add_perm("core.create_person_rule", create_person_predicate)
 
 # Create group
 create_group_predicate = has_person & (
     has_global_perm("core.create_group") | has_object_perm("core.create_group")
 )
-rules.add_perm("core.create_group", create_group_predicate)
+rules.add_perm("core.create_group_rule", create_group_predicate)
 
 # School years
 view_school_term_predicate = has_person & has_global_perm("core.view_schoolterm")
-rules.add_perm("core.view_schoolterm", view_school_term_predicate)
+rules.add_perm("core.view_schoolterm_rule", view_school_term_predicate)
 
 create_school_term_predicate = has_person & has_global_perm("core.add_schoolterm")
-rules.add_perm("core.create_schoolterm", create_school_term_predicate)
+rules.add_perm("core.create_schoolterm_rule", create_school_term_predicate)
 
 edit_school_term_predicate = has_person & has_global_perm("core.change_schoolterm")
-rules.add_perm("core.edit_schoolterm", edit_school_term_predicate)
+rules.add_perm("core.edit_schoolterm_rule", edit_school_term_predicate)
 
 # View admin menu
 view_admin_menu_predicate = has_person & (
@@ -279,70 +279,70 @@ view_admin_menu_predicate = has_person & (
     | view_system_status_predicate
     | view_announcements_predicate
 )
-rules.add_perm("core.view_admin_menu", view_admin_menu_predicate)
+rules.add_perm("core.view_admin_menu_rule", view_admin_menu_predicate)
 
 # View group stats
 view_group_stats_predicate = has_person & (
     has_global_perm("core.view_group_stats") | has_object_perm("core.view_group_stats")
 )
-rules.add_perm("core.view_group_stats", view_group_stats_predicate)
+rules.add_perm("core.view_group_stats_rule", view_group_stats_predicate)
 
 # View data check results
 view_data_check_results_predicate = has_person & has_global_perm("core.view_datacheckresult")
-rules.add_perm("core.view_datacheckresults", view_data_check_results_predicate)
+rules.add_perm("core.view_datacheckresults_rule", view_data_check_results_predicate)
 
 # Run data checks
 run_data_checks_predicate = (
     has_person & view_data_check_results_predicate & has_global_perm("core.run_data_checks")
 )
-rules.add_perm("core.run_data_checks", run_data_checks_predicate)
+rules.add_perm("core.run_data_checks_rule", run_data_checks_predicate)
 
 # Solve data problems
 solve_data_problem_predicate = (
     has_person & view_data_check_results_predicate & has_global_perm("core.solve_data_problem")
 )
-rules.add_perm("core.solve_data_problem", solve_data_problem_predicate)
+rules.add_perm("core.solve_data_problem_rule", solve_data_problem_predicate)
 
 view_dashboard_widget_predicate = has_person & has_global_perm("core.view_dashboardwidget")
-rules.add_perm("core.view_dashboardwidget", view_dashboard_widget_predicate)
+rules.add_perm("core.view_dashboardwidget_rule", view_dashboard_widget_predicate)
 
 create_dashboard_widget_predicate = has_person & has_global_perm("core.add_dashboardwidget")
-rules.add_perm("core.create_dashboardwidget", create_dashboard_widget_predicate)
+rules.add_perm("core.create_dashboardwidget_rule", create_dashboard_widget_predicate)
 
 edit_dashboard_widget_predicate = has_person & has_global_perm("core.change_dashboardwidget")
-rules.add_perm("core.edit_dashboardwidget", edit_dashboard_widget_predicate)
+rules.add_perm("core.edit_dashboardwidget_rule", edit_dashboard_widget_predicate)
 
 delete_dashboard_widget_predicate = has_person & has_global_perm("core.delete_dashboardwidget")
-rules.add_perm("core.delete_dashboardwidget", delete_dashboard_widget_predicate)
+rules.add_perm("core.delete_dashboardwidget_rule", delete_dashboard_widget_predicate)
 
 edit_dashboard_predicate = is_site_preference_set("general", "dashboard_editing") & has_person
-rules.add_perm("core.edit_dashboard", edit_dashboard_predicate)
+rules.add_perm("core.edit_dashboard_rule", edit_dashboard_predicate)
 
 edit_default_dashboard_predicate = has_person & has_global_perm("core.edit_default_dashboard")
-rules.add_perm("core.edit_default_dashboard", edit_default_dashboard_predicate)
+rules.add_perm("core.edit_default_dashboard_rule", edit_default_dashboard_predicate)
 
 # OAuth2 permissions
 add_oauth_applications_predicate = has_person & has_global_perm("core.add_oauth_applications")
-rules.add_perm("core.add_oauth_applications", add_oauth_applications_predicate)
+rules.add_perm("core.add_oauth_applications_rule", add_oauth_applications_predicate)
 
 list_oauth_applications_predicate = has_person & has_global_perm("core.list_oauth_applications")
-rules.add_perm("core.list_oauth_applications", list_oauth_applications_predicate)
+rules.add_perm("core.list_oauth_applications_rule", list_oauth_applications_predicate)
 
 view_oauth_applications_predicate = has_person & has_global_perm("core.view_oauth_applications")
-rules.add_perm("core.view_oauth_applications", view_oauth_applications_predicate)
+rules.add_perm("core.view_oauth_applications_rule", view_oauth_applications_predicate)
 
 update_oauth_applications_predicate = has_person & has_global_perm("core.update_oauth_applications")
-rules.add_perm("core.update_oauth_applications", update_oauth_applications_predicate)
+rules.add_perm("core.update_oauth_applications_rule", update_oauth_applications_predicate)
 
 delete_oauth_applications_predicate = has_person & has_global_perm("core.delete_oauth_applications")
-rules.add_perm("core.delete_oauth_applications", delete_oauth_applications_predicate)
+rules.add_perm("core.delete_oauth_applications_rule", delete_oauth_applications_predicate)
 
 # Upload and browse files via CKEditor
 upload_files_ckeditor_predicate = has_person & has_global_perm("core.upload_files_ckeditor")
-rules.add_perm("core.upload_files_ckeditor", upload_files_ckeditor_predicate)
+rules.add_perm("core.upload_files_ckeditor_rule", upload_files_ckeditor_predicate)
 
 test_pdf_generation_predicate = has_person & has_global_perm("core.test_pdf")
-rules.add_perm("core.test_pdf", test_pdf_generation_predicate)
+rules.add_perm("core.test_pdf_rule", test_pdf_generation_predicate)
 
 # Generate rules for syncable fields
 for field in Person._meta.fields:
@@ -354,4 +354,4 @@ for field in Person._meta.fields:
             & contains_site_preference_value("account", "editable_fields_person", field.name)
         )
     )
-    rules.add_perm(f"core.change_person_field_{field.name}", perm)
+    rules.add_perm(f"core.change_person_field_{field.name}_rule", perm)
diff --git a/aleksis/core/settings.py b/aleksis/core/settings.py
index b0967c17c99df7ef90e9d2732806fabb8f90157d..9a4be3627bccbcb163465cffe1d3e5f49ff76a18 100644
--- a/aleksis/core/settings.py
+++ b/aleksis/core/settings.py
@@ -70,7 +70,7 @@ UWSGI = {
     "module": "aleksis.core.wsgi",
 }
 UWSGI_SERVE_STATIC = True
-UWSGI_SERVE_MEDIA = True
+UWSGI_SERVE_MEDIA = False
 
 ALLOWED_HOSTS = _settings.get("http.allowed_hosts", [])
 
@@ -831,7 +831,8 @@ if _settings.get("storage.type", "").lower() == "s3":
     AWS_S3_SIGNATURE_VERSION = _settings.get("storage.s3.signature_version", None)
     AWS_S3_FILE_OVERWRITE = _settings.get("storage.s3.file_overwrite", False)
 else:
-    DEFAULT_FILE_STORAGE = "django.core.files.storage.FileSystemStorage"
+    DEFAULT_FILE_STORAGE = "titofisto.TitofistoStorage"
+    TITOFISTO_TIMEOUT = 10 * 60
 
 SASS_PROCESSOR_STORAGE = DEFAULT_FILE_STORAGE
 
diff --git a/aleksis/core/tests/browser/test_selenium.py b/aleksis/core/tests/browser/test_selenium.py
index 8afd4b1584e3b5e6f35d69b2df73625ad8da5fad..e14ad8b9f123cd612848af566790d7e649d47bcc 100644
--- a/aleksis/core/tests/browser/test_selenium.py
+++ b/aleksis/core/tests/browser/test_selenium.py
@@ -77,5 +77,5 @@ class SeleniumTests(SeleniumTestCase):
         self._login()
         self._create_person()
         self.selenium.get(self.live_server_url + reverse("test_pdf"))
-        el = WebDriverWait(self.selenium, 10).until(lambda d: ".pdf" in self.selenium.current_url)
+        el = WebDriverWait(self.selenium, 20).until(lambda d: ".pdf" in self.selenium.current_url)
         self._screenshot("pdf.png")
diff --git a/aleksis/core/urls.py b/aleksis/core/urls.py
index 9ccf5aebff5c5fd36947626584cd6287dad5a3c7..57aabbd8ca929f938426335acafde12346b1c973 100644
--- a/aleksis/core/urls.py
+++ b/aleksis/core/urls.py
@@ -19,6 +19,7 @@ from . import views
 urlpatterns = [
     path("", include("django_prometheus.urls")),
     path("", include("pwa.urls"), name="pwa"),
+    path(settings.MEDIA_URL.removeprefix("/"), include("titofisto.urls")),
     path("about/", views.about, name="about_aleksis"),
     path("admin/", admin.site.urls),
     path("admin/uwsgi/", include("django_uwsgi.urls")),
diff --git a/aleksis/core/util/core_helpers.py b/aleksis/core/util/core_helpers.py
index 1e67e32b6e8e86346e5f5df340aebf0c7021f829..a1423bd5b4c15dd50d0665e1257b822bf55115c0 100644
--- a/aleksis/core/util/core_helpers.py
+++ b/aleksis/core/util/core_helpers.py
@@ -130,12 +130,23 @@ def get_or_create_favicon(title: str, default: str, is_favicon: bool = False) ->
     """Ensure that there is always a favicon object."""
     from favicon.models import Favicon  # noqa
 
-    favicon, created = Favicon.on_site.update_or_create(
+    favicon, created = Favicon.on_site.get_or_create(
         title=title, defaults={"isFavicon": is_favicon}
     )
+
+    changed = False
+
+    if favicon.isFavicon != is_favicon:
+        favicon.isFavicon = True
+        changed = True
+
     if created:
         favicon.faviconImage.save(os.path.basename(default), File(open(default, "rb")))
+        changed = True
+
+    if changed:
         favicon.save()
+
     return favicon
 
 
@@ -225,11 +236,14 @@ def objectgetter_optional(
 ) -> Callable[[HttpRequest, Optional[int]], Model]:
     """Get an object by pk, defaulting to None."""
 
-    def get_object(request: HttpRequest, id_: Optional[int] = None, **kwargs) -> Model:
+    def get_object(request: HttpRequest, id_: Optional[int] = None, **kwargs) -> Optional[Model]:
         if id_ is not None:
             return get_object_or_404(model, pk=id_)
         else:
-            return eval(default) if default_eval else default  # noqa:S307
+            try:
+                return eval(default) if default_eval else default  # noqa:S307
+            except (AttributeError, KeyError, IndexError):
+                return None
 
     return get_object
 
diff --git a/aleksis/core/views.py b/aleksis/core/views.py
index 78775e0725c23533272e93dc28bf9f4a4c89bdf6..38f336843d590f8875a52d03416dec89a9152583 100644
--- a/aleksis/core/views.py
+++ b/aleksis/core/views.py
@@ -100,7 +100,7 @@ class RenderPDFView(TemplateView):
         return render_pdf(request, self.template_name, context)
 
 
-@permission_required("core.view_dashboard")
+@permission_required("core.view_dashboard_rule")
 def index(request: HttpRequest) -> HttpResponse:
     """View for dashboard."""
     context = {}
@@ -137,7 +137,7 @@ def index(request: HttpRequest) -> HttpResponse:
 
 
 class NotificationsListView(PermissionRequiredMixin, ListView):
-    permission_required = "core.view_notifications"
+    permission_required = "core.view_notifications_rule"
     template_name = "core/notifications.html"
 
     def get_queryset(self) -> QuerySet:
@@ -164,7 +164,7 @@ class SchoolTermListView(PermissionRequiredMixin, SingleTableView):
 
     model = SchoolTerm
     table_class = SchoolTermTable
-    permission_required = "core.view_schoolterm"
+    permission_required = "core.view_schoolterm_rule"
     template_name = "core/school_term/list.html"
 
 
@@ -174,7 +174,7 @@ class SchoolTermCreateView(PermissionRequiredMixin, AdvancedCreateView):
 
     model = SchoolTerm
     form_class = SchoolTermForm
-    permission_required = "core.add_schoolterm"
+    permission_required = "core.add_schoolterm_rule"
     template_name = "core/school_term/create.html"
     success_url = reverse_lazy("school_terms")
     success_message = _("The school term has been created.")
@@ -192,7 +192,7 @@ class SchoolTermEditView(PermissionRequiredMixin, AdvancedEditView):
     success_message = _("The school term has been saved.")
 
 
-@permission_required("core.view_persons")
+@permission_required("core.view_persons_rule")
 def persons(request: HttpRequest) -> HttpResponse:
     """List view listing all persons."""
     context = {}
@@ -215,7 +215,7 @@ def persons(request: HttpRequest) -> HttpResponse:
 
 
 @permission_required(
-    "core.view_person", fn=objectgetter_optional(Person, "request.user.person", True)
+    "core.view_person_rule", fn=objectgetter_optional(Person, "request.user.person", True)
 )
 def person(request: HttpRequest, id_: Optional[int] = None) -> HttpResponse:
     """Detail view for one person; defaulting to logged-in person."""
@@ -235,7 +235,7 @@ def person(request: HttpRequest, id_: Optional[int] = None) -> HttpResponse:
     return render(request, "core/person/full.html", context)
 
 
-@permission_required("core.view_group", fn=objectgetter_optional(Group, None, False))
+@permission_required("core.view_group_rule", fn=objectgetter_optional(Group, None, False))
 def group(request: HttpRequest, id_: int) -> HttpResponse:
     """Detail view for one group."""
     context = {}
@@ -268,7 +268,7 @@ def group(request: HttpRequest, id_: int) -> HttpResponse:
     return render(request, "core/group/full.html", context)
 
 
-@permission_required("core.view_groups")
+@permission_required("core.view_groups_rule")
 def groups(request: HttpRequest) -> HttpResponse:
     """List view for listing all groups."""
     context = {}
@@ -289,7 +289,7 @@ def groups(request: HttpRequest) -> HttpResponse:
 
 
 @never_cache
-@permission_required("core.link_persons_accounts")
+@permission_required("core.link_persons_accounts_rule")
 def persons_accounts(request: HttpRequest) -> HttpResponse:
     """View allowing to batch-process linking of users to persons."""
     context = {}
@@ -310,7 +310,7 @@ def persons_accounts(request: HttpRequest) -> HttpResponse:
 
 
 @never_cache
-@permission_required("core.assign_child_groups_to_groups")
+@permission_required("core.assign_child_groups_to_groups_rule")
 def groups_child_groups(request: HttpRequest) -> HttpResponse:
     """View for batch-processing assignment from child groups to groups."""
     context = {}
@@ -348,7 +348,7 @@ def groups_child_groups(request: HttpRequest) -> HttpResponse:
 
 
 @never_cache
-@permission_required("core.edit_person", fn=objectgetter_optional(Person))
+@permission_required("core.edit_person_rule", fn=objectgetter_optional(Person))
 def edit_person(request: HttpRequest, id_: Optional[int] = None) -> HttpResponse:
     """Edit view for a single person, defaulting to logged-in person."""
     context = {}
@@ -363,7 +363,7 @@ def edit_person(request: HttpRequest, id_: Optional[int] = None) -> HttpResponse
         )
     else:
         # Empty form to create a new group
-        if request.user.has_perm("core.create_person"):
+        if request.user.has_perm("core.create_person_rule"):
             edit_person_form = EditPersonForm(request, request.POST or None, request.FILES or None)
         else:
             raise PermissionDenied()
@@ -410,7 +410,7 @@ def get_group_by_id(request: HttpRequest, id_: Optional[int] = None):
 
 
 @never_cache
-@permission_required("core.edit_group", fn=objectgetter_optional(Group, None, False))
+@permission_required("core.edit_group_rule", fn=objectgetter_optional(Group, None, False))
 def edit_group(request: HttpRequest, id_: Optional[int] = None) -> HttpResponse:
     """View to edit or create a group."""
     context = {}
@@ -423,7 +423,7 @@ def edit_group(request: HttpRequest, id_: Optional[int] = None) -> HttpResponse:
         edit_group_form = EditGroupForm(request.POST or None, instance=group)
     else:
         # Empty form to create a new group
-        if request.user.has_perm("core.create_group"):
+        if request.user.has_perm("core.create_group_rule"):
             edit_group_form = EditGroupForm(request.POST or None)
         else:
             raise PermissionDenied()
@@ -443,7 +443,7 @@ def edit_group(request: HttpRequest, id_: Optional[int] = None) -> HttpResponse:
     return render(request, "core/group/edit.html", context)
 
 
-@permission_required("core.manage_data")
+@permission_required("core.manage_data_rule")
 def data_management(request: HttpRequest) -> HttpResponse:
     """View with special menu for data management."""
     context = {}
@@ -454,7 +454,7 @@ class SystemStatus(PermissionRequiredMixin, MainView):
     """View giving information about the system status."""
 
     template_name = "core/pages/system_status.html"
-    permission_required = "core.view_system_status"
+    permission_required = "core.view_system_status_rule"
     context = {}
 
     def get(self, request, *args, **kwargs):
@@ -479,11 +479,11 @@ class SystemStatus(PermissionRequiredMixin, MainView):
 
 class TestPDFGenerationView(PermissionRequiredMixin, RenderPDFView):
     template_name = "core/pages/test_pdf.html"
-    permission_required = "core.test_pdf"
+    permission_required = "core.test_pdf_rule"
 
 
 @permission_required(
-    "core.mark_notification_as_read", fn=objectgetter_optional(Notification, None, False)
+    "core.mark_notification_as_read_rule", fn=objectgetter_optional(Notification, None, False)
 )
 def notification_mark_read(request: HttpRequest, id_: int) -> HttpResponse:
     """Mark a notification read."""
@@ -496,7 +496,7 @@ def notification_mark_read(request: HttpRequest, id_: int) -> HttpResponse:
     return redirect("index")
 
 
-@permission_required("core.view_announcements")
+@permission_required("core.view_announcements_rule")
 def announcements(request: HttpRequest) -> HttpResponse:
     """List view of announcements."""
     context = {}
@@ -510,7 +510,7 @@ def announcements(request: HttpRequest) -> HttpResponse:
 
 @never_cache
 @permission_required(
-    "core.create_or_edit_announcement", fn=objectgetter_optional(Announcement, None, False)
+    "core.create_or_edit_announcement_rule", fn=objectgetter_optional(Announcement, None, False)
 )
 def announcement_form(request: HttpRequest, id_: Optional[int] = None) -> HttpResponse:
     """View to create or edit an announcement."""
@@ -540,7 +540,7 @@ def announcement_form(request: HttpRequest, id_: Optional[int] = None) -> HttpRe
 
 
 @permission_required(
-    "core.delete_announcement", fn=objectgetter_optional(Announcement, None, False)
+    "core.delete_announcement_rule", fn=objectgetter_optional(Announcement, None, False)
 )
 def delete_announcement(request: HttpRequest, id_: int) -> HttpResponse:
     """View to delete an announcement."""
@@ -552,7 +552,7 @@ def delete_announcement(request: HttpRequest, id_: int) -> HttpResponse:
     return redirect("announcements")
 
 
-@permission_required("core.search")
+@permission_required("core.search_rule")
 def searchbar_snippets(request: HttpRequest) -> HttpResponse:
     """View to return HTML snippet with searchbar autocompletion results."""
     query = request.GET.get("q", "")
@@ -567,7 +567,7 @@ def searchbar_snippets(request: HttpRequest) -> HttpResponse:
 class PermissionSearchView(PermissionRequiredMixin, SearchView):
     """Wrapper to apply permission to haystack's search view."""
 
-    permission_required = "core.search"
+    permission_required = "core.search_rule"
 
     def create_response(self):
         context = self.get_context()
@@ -592,21 +592,21 @@ def preferences(
         instance = request.site
         form_class = SitePreferenceForm
 
-        if not request.user.has_perm("core.change_site_preferences", instance):
+        if not request.user.has_perm("core.change_site_preferences_rule", instance):
             raise PermissionDenied()
     elif registry_name == "person":
         registry = person_preferences_registry
         instance = objectgetter_optional(Person, "request.user.person", True)(request, pk)
         form_class = PersonPreferenceForm
 
-        if not request.user.has_perm("core.change_person_preferences", instance):
+        if not request.user.has_perm("core.change_person_preferences_rule", instance):
             raise PermissionDenied()
     elif registry_name == "group":
         registry = group_preferences_registry
         instance = objectgetter_optional(Group, None, False)(request, pk)
         form_class = GroupPreferenceForm
 
-        if not request.user.has_perm("core.change_group_preferences", instance):
+        if not request.user.has_perm("core.change_group_preferences_rule", instance):
             raise PermissionDenied()
     else:
         # Invalid registry name passed from URL
@@ -640,7 +640,7 @@ def preferences(
     return render(request, "dynamic_preferences/form.html", context)
 
 
-@permission_required("core.delete_person", fn=objectgetter_optional(Person))
+@permission_required("core.delete_person_rule", fn=objectgetter_optional(Person))
 def delete_person(request: HttpRequest, id_: int) -> HttpResponse:
     """View to delete an person."""
     person = objectgetter_optional(Person)(request, id_)
@@ -655,7 +655,7 @@ def delete_person(request: HttpRequest, id_: int) -> HttpResponse:
     return redirect("persons")
 
 
-@permission_required("core.delete_group", fn=objectgetter_optional(Group))
+@permission_required("core.delete_group_rule", fn=objectgetter_optional(Group))
 def delete_group(request: HttpRequest, id_: int) -> HttpResponse:
     """View to delete an group."""
     group = objectgetter_optional(Group)(request, id_)
@@ -671,7 +671,7 @@ def delete_group(request: HttpRequest, id_: int) -> HttpResponse:
 
 @never_cache
 @permission_required(
-    "core.change_additionalfield", fn=objectgetter_optional(AdditionalField, None, False)
+    "core.change_additionalfield_rule", fn=objectgetter_optional(AdditionalField, None, False)
 )
 def edit_additional_field(request: HttpRequest, id_: Optional[int] = None) -> HttpResponse:
     """View to edit or create a additional_field."""
@@ -686,7 +686,7 @@ def edit_additional_field(request: HttpRequest, id_: Optional[int] = None) -> Ht
             request.POST or None, instance=additional_field
         )
     else:
-        if request.user.has_perm("core.create_additionalfield"):
+        if request.user.has_perm("core.create_additionalfield_rule"):
             # Empty form to create a new additional_field
             edit_additional_field_form = EditAdditionalFieldForm(request.POST or None)
         else:
@@ -705,7 +705,7 @@ def edit_additional_field(request: HttpRequest, id_: Optional[int] = None) -> Ht
     return render(request, "core/additional_field/edit.html", context)
 
 
-@permission_required("core.view_additionalfields")
+@permission_required("core.view_additionalfields_rule")
 def additional_fields(request: HttpRequest) -> HttpResponse:
     """List view for listing all additional fields."""
     context = {}
@@ -724,7 +724,7 @@ def additional_fields(request: HttpRequest) -> HttpResponse:
 
 
 @permission_required(
-    "core.delete_additionalfield", fn=objectgetter_optional(AdditionalField, None, False)
+    "core.delete_additionalfield_rule", fn=objectgetter_optional(AdditionalField, None, False)
 )
 def delete_additional_field(request: HttpRequest, id_: int) -> HttpResponse:
     """View to delete an additional field."""
@@ -736,7 +736,7 @@ def delete_additional_field(request: HttpRequest, id_: int) -> HttpResponse:
 
 
 @never_cache
-@permission_required("core.change_grouptype", fn=objectgetter_optional(GroupType, None, False))
+@permission_required("core.change_grouptype_rule", fn=objectgetter_optional(GroupType, None, False))
 def edit_group_type(request: HttpRequest, id_: Optional[int] = None) -> HttpResponse:
     """View to edit or create a group_type."""
     context = {}
@@ -764,7 +764,7 @@ def edit_group_type(request: HttpRequest, id_: Optional[int] = None) -> HttpResp
     return render(request, "core/group_type/edit.html", context)
 
 
-@permission_required("core.view_grouptypes")
+@permission_required("core.view_grouptypes_rule")
 def group_types(request: HttpRequest) -> HttpResponse:
     """List view for listing all group types."""
     context = {}
@@ -780,7 +780,7 @@ def group_types(request: HttpRequest) -> HttpResponse:
     return render(request, "core/group_type/list.html", context)
 
 
-@permission_required("core.delete_grouptype", fn=objectgetter_optional(GroupType, None, False))
+@permission_required("core.delete_grouptype_rule", fn=objectgetter_optional(GroupType, None, False))
 def delete_group_type(request: HttpRequest, id_: int) -> HttpResponse:
     """View to delete an group_type."""
     group_type = objectgetter_optional(GroupType, None, False)(request, id_)
@@ -791,13 +791,17 @@ def delete_group_type(request: HttpRequest, id_: int) -> HttpResponse:
 
 
 class DataCheckView(PermissionRequiredMixin, ListView):
-    permission_required = "core.view_datacheckresults"
+    permission_required = "core.view_datacheckresults_rule"
     model = DataCheckResult
     template_name = "core/data_check/list.html"
     context_object_name = "results"
 
     def get_queryset(self) -> QuerySet:
-        return DataCheckResult.objects.filter(solved=False).order_by("check")
+        return (
+            DataCheckResult.objects.filter(content_type__app_label__in=apps.app_configs.keys())
+            .filter(solved=False)
+            .order_by("check")
+        )
 
     def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
         context = super().get_context_data(**kwargs)
@@ -806,7 +810,7 @@ class DataCheckView(PermissionRequiredMixin, ListView):
 
 
 class RunDataChecks(PermissionRequiredMixin, View):
-    permission_required = "core.run_data_checks"
+    permission_required = "core.run_data_checks_rule"
 
     def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
         result = check_data.delay()
@@ -824,7 +828,7 @@ class RunDataChecks(PermissionRequiredMixin, View):
 
 class SolveDataCheckView(PermissionRequiredMixin, RevisionMixin, DetailView):
     queryset = DataCheckResult.objects.all()
-    permission_required = "core.solve_data_problem"
+    permission_required = "core.solve_data_problem_rule"
 
     def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
         solve_option = self.kwargs["solve_option"]
@@ -851,7 +855,7 @@ class DashboardWidgetListView(PermissionRequiredMixin, SingleTableView):
 
     model = DashboardWidget
     table_class = DashboardWidgetTable
-    permission_required = "core.view_dashboardwidget"
+    permission_required = "core.view_dashboardwidget_rule"
     template_name = "core/dashboard_widget/list.html"
 
     def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
@@ -872,7 +876,7 @@ class DashboardWidgetEditView(PermissionRequiredMixin, AdvancedEditView):
 
     model = DashboardWidget
     fields = "__all__"
-    permission_required = "core.edit_dashboardwidget"
+    permission_required = "core.edit_dashboardwidget_rule"
     template_name = "core/dashboard_widget/edit.html"
     success_url = reverse_lazy("dashboard_widgets")
     success_message = _("The dashboard widget has been saved.")
@@ -902,7 +906,7 @@ class DashboardWidgetCreateView(PermissionRequiredMixin, AdvancedCreateView):
         return super().post(request, *args, **kwargs)
 
     fields = "__all__"
-    permission_required = "core.add_dashboardwidget"
+    permission_required = "core.add_dashboardwidget_rule"
     template_name = "core/dashboard_widget/create.html"
     success_url = reverse_lazy("dashboard_widgets")
     success_message = _("The dashboard widget has been created.")
@@ -912,7 +916,7 @@ class DashboardWidgetDeleteView(PermissionRequiredMixin, AdvancedDeleteView):
     """Delete view for dashboard widgets."""
 
     model = DashboardWidget
-    permission_required = "core.delete_dashboardwidget"
+    permission_required = "core.delete_dashboardwidget_rule"
     template_name = "core/pages/delete.html"
     success_url = reverse_lazy("dashboard_widgets")
     success_message = _("The dashboard widget has been deleted.")
@@ -921,13 +925,13 @@ class DashboardWidgetDeleteView(PermissionRequiredMixin, AdvancedDeleteView):
 class EditDashboardView(PermissionRequiredMixin, View):
     """View for editing dashboard widget order."""
 
-    permission_required = "core.edit_dashboard"
+    permission_required = "core.edit_dashboard_rule"
 
     def get_context_data(self, request, **kwargs):
         context = {}
         self.default_dashboard = kwargs.get("default", False)
 
-        if self.default_dashboard and not request.user.has_perm("core.edit_default_dashboard"):
+        if self.default_dashboard and not request.user.has_perm("core.edit_default_dashboard_rule"):
             raise PermissionDenied()
 
         context["default_dashboard"] = self.default_dashboard
@@ -997,7 +1001,7 @@ class EditDashboardView(PermissionRequiredMixin, View):
 class OAuth2List(PermissionRequiredMixin, ListView):
     """List view for all the applications."""
 
-    permission_required = "core.list_oauth_applications"
+    permission_required = "core.list_oauth_applications_rule"
     context_object_name = "applications"
     template_name = "oauth2_provider/application_list.html"
 
@@ -1009,7 +1013,7 @@ class OAuth2Detail(PermissionRequiredMixin, DetailView):
     """Detail view for an application instance."""
 
     context_object_name = "application"
-    permission_required = "core.view_oauth_applications"
+    permission_required = "core.view_oauth_applications_rule"
     template_name = "oauth2_provider/application_detail.html"
 
     def get_queryset(self):
@@ -1019,7 +1023,7 @@ class OAuth2Detail(PermissionRequiredMixin, DetailView):
 class OAuth2Delete(PermissionRequiredMixin, DeleteView):
     """View used to delete an application."""
 
-    permission_required = "core.delete_oauth_applications"
+    permission_required = "core.delete_oauth_applications_rule"
     context_object_name = "application"
     success_url = reverse_lazy("oauth_list")
     template_name = "oauth2_provider/application_confirm_delete.html"
@@ -1031,7 +1035,7 @@ class OAuth2Delete(PermissionRequiredMixin, DeleteView):
 class OAuth2Update(PermissionRequiredMixin, UpdateView):
     """View used to update an application."""
 
-    permission_required = "core.update_oauth_applications"
+    permission_required = "core.update_oauth_applications_rule"
     context_object_name = "application"
     template_name = "oauth2_provider/application_form.html"
 
diff --git a/poetry.lock b/poetry.lock
index 262440f8988dcd1a6d03b46dfca5e429ba14b5e0..b9845f4e216c7ffd5c07d0e58f6c3889ab25a05c 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -81,9 +81,6 @@ category = "main"
 optional = false
 python-versions = ">=3.6"
 
-[package.dependencies]
-typing-extensions = {version = "*", markers = "python_version < \"3.8\""}
-
 [package.extras]
 tests = ["pytest", "pytest-asyncio", "mypy (>=0.800)"]
 
@@ -1128,6 +1125,17 @@ pytz = "*"
 [package.extras]
 rest_framework = ["djangorestframework (>=3.0.0)"]
 
+[[package]]
+name = "django-titofisto"
+version = "0.1.0"
+description = "Django Time-Token File Storage"
+category = "main"
+optional = false
+python-versions = ">=3.9,<4.0"
+
+[package.dependencies]
+Django = ">2.2,<4.0"
+
 [[package]]
 name = "django-two-factor-auth"
 version = "1.13.1"
@@ -1262,7 +1270,6 @@ optional = false
 python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,>=2.7"
 
 [package.dependencies]
-importlib-metadata = {version = "*", markers = "python_version < \"3.8\""}
 mccabe = ">=0.6.0,<0.7.0"
 pycodestyle = ">=2.7.0,<2.8.0"
 pyflakes = ">=2.3.0,<2.4.0"
@@ -1424,7 +1431,6 @@ python-versions = ">=3.5"
 
 [package.dependencies]
 gitdb = ">=4.0.1,<5"
-typing-extensions = {version = ">=3.7.4.0", markers = "python_version < \"3.8\""}
 
 [[package]]
 name = "html2text"
@@ -1450,22 +1456,6 @@ category = "dev"
 optional = false
 python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*"
 
-[[package]]
-name = "importlib-metadata"
-version = "4.0.1"
-description = "Read metadata from Python packages"
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[package.dependencies]
-typing-extensions = {version = ">=3.6.4", markers = "python_version < \"3.8\""}
-zipp = ">=0.5"
-
-[package.extras]
-docs = ["sphinx", "jaraco.packaging (>=8.2)", "rst.linker (>=1.9)"]
-testing = ["pytest (>=4.6)", "pytest-checkdocs (>=2.4)", "pytest-flake8", "pytest-cov", "pytest-enabler (>=1.0.1)", "packaging", "pep517", "pyfakefs", "flufl.flake8", "pytest-black (>=0.3.7)", "pytest-mypy", "importlib-resources (>=1.3)"]
-
 [[package]]
 name = "iniconfig"
 version = "1.1.1"
@@ -1585,7 +1575,6 @@ python-versions = ">=3.6"
 
 [package.dependencies]
 amqp = ">=5.0.0,<6.0.0"
-importlib-metadata = {version = ">=0.18", markers = "python_version < \"3.8\""}
 
 [package.extras]
 azureservicebus = ["azure-servicebus (>=0.21.1)"]
@@ -1798,9 +1787,6 @@ category = "dev"
 optional = false
 python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*"
 
-[package.dependencies]
-importlib-metadata = {version = ">=0.12", markers = "python_version < \"3.8\""}
-
 [package.extras]
 dev = ["pre-commit", "tox"]
 
@@ -1964,7 +1950,6 @@ python-versions = ">=3.6"
 atomicwrites = {version = ">=1.0", markers = "sys_platform == \"win32\""}
 attrs = ">=19.2.0"
 colorama = {version = "*", markers = "sys_platform == \"win32\""}
-importlib-metadata = {version = ">=0.12", markers = "python_version < \"3.8\""}
 iniconfig = "*"
 packaging = "*"
 pluggy = ">=0.12,<1.0.0a1"
@@ -2412,7 +2397,6 @@ optional = false
 python-versions = ">=3.6"
 
 [package.dependencies]
-importlib-metadata = {version = ">=1.7.0", markers = "python_version < \"3.8\""}
 pbr = ">=2.0.0,<2.1.0 || >2.1.0"
 
 [[package]]
@@ -2531,7 +2515,7 @@ python-versions = "*"
 name = "typing-extensions"
 version = "3.10.0.0"
 description = "Backported and Experimental Type Hints for Python 3.5+"
-category = "main"
+category = "dev"
 optional = false
 python-versions = "*"
 
@@ -2611,18 +2595,6 @@ python-versions = "*"
 [package.dependencies]
 pycryptodome = "*"
 
-[[package]]
-name = "zipp"
-version = "3.4.1"
-description = "Backport of pathlib-compatible object wrapper for zip files"
-category = "main"
-optional = false
-python-versions = ">=3.6"
-
-[package.extras]
-docs = ["sphinx", "jaraco.packaging (>=8.2)", "rst.linker (>=1.9)"]
-testing = ["pytest (>=4.6)", "pytest-checkdocs (>=1.2.3)", "pytest-flake8", "pytest-cov", "pytest-enabler", "jaraco.itertools", "func-timeout", "pytest-black (>=0.3.7)", "pytest-mypy"]
-
 [extras]
 ldap = ["django-auth-ldap"]
 s3 = ["boto3", "django-storages"]
@@ -2631,8 +2603,8 @@ xapian = ["xapian-haystack"]
 
 [metadata]
 lock-version = "1.1"
-python-versions = "^3.7"
-content-hash = "ece8bce6b86fecc86d3f19eeb1d1f4682213c8a8cc253fddb37a432bdeb604ea"
+python-versions = "^3.9"
+content-hash = "018e1ad1970093f5ea8ddb246d87face02df8e03ceec4df616e3be2b3eb18491"
 
 [metadata.files]
 alabaster = [
@@ -3084,6 +3056,10 @@ django-timezone-field = [
     {file = "django-timezone-field-4.1.2.tar.gz", hash = "sha256:cffac62452d060e365938aa9c9f7b72d70d8b26b9c60243bce227b35abd1b9df"},
     {file = "django_timezone_field-4.1.2-py3-none-any.whl", hash = "sha256:897c06e40b619cf5731a30d6c156886a7c64cba3a90364832148da7ef32ccf36"},
 ]
+django-titofisto = [
+    {file = "django-titofisto-0.1.0.tar.gz", hash = "sha256:489362877d2efeddc7bd1209ce9f919b458d657a952ed5952d5364bbf834663a"},
+    {file = "django_titofisto-0.1.0-py3-none-any.whl", hash = "sha256:5215e9b153b500c8e813632a2c024b0e34c4ddedeb321cd34e9bb1e7ba3e7237"},
+]
 django-two-factor-auth = [
     {file = "django-two-factor-auth-1.13.1.tar.gz", hash = "sha256:a20e03d256fd9fd668988545f052cedcc47e5a981888562e5e27d0bb83deae89"},
     {file = "django_two_factor_auth-1.13.1-py2.py3-none-any.whl", hash = "sha256:d270d4288731233621a9462a89a8dfed2dcb86fa354125c816a89772d55f9e29"},
@@ -3128,6 +3104,7 @@ flake8-bandit = [
 ]
 flake8-black = [
     {file = "flake8-black-0.2.1.tar.gz", hash = "sha256:f26651bc10db786c03f4093414f7c9ea982ed8a244cec323c984feeffdf4c118"},
+    {file = "flake8_black-0.2.1-py3-none-any.whl", hash = "sha256:941514149cb8b489cb17a4bb1cf18d84375db3b34381bb018de83509437931a0"},
 ]
 flake8-builtins = [
     {file = "flake8-builtins-1.5.3.tar.gz", hash = "sha256:09998853b2405e98e61d2ff3027c47033adbdc17f9fe44ca58443d876eb00f3b"},
@@ -3185,10 +3162,6 @@ imagesize = [
     {file = "imagesize-1.2.0-py2.py3-none-any.whl", hash = "sha256:6965f19a6a2039c7d48bca7dba2473069ff854c36ae6f19d2cde309d998228a1"},
     {file = "imagesize-1.2.0.tar.gz", hash = "sha256:b1f6b5a4eab1f73479a50fb79fcf729514a900c341d8503d62a62dbc4127a2b1"},
 ]
-importlib-metadata = [
-    {file = "importlib_metadata-4.0.1-py3-none-any.whl", hash = "sha256:d7eb1dea6d6a6086f8be21784cc9e3bcfa55872b52309bc5fad53a8ea444465d"},
-    {file = "importlib_metadata-4.0.1.tar.gz", hash = "sha256:8c501196e49fb9df5df43833bdb1e4328f64847763ec8a50703148b73784d581"},
-]
 iniconfig = [
     {file = "iniconfig-1.1.1-py2.py3-none-any.whl", hash = "sha256:011e24c64b7f47f6ebd835bb12a743f2fbe9a26d4cecaa7f53bc4f35ee9da8b3"},
     {file = "iniconfig-1.1.1.tar.gz", hash = "sha256:bc3af051d7d14b2ee5ef9969666def0cd1a000e121eaea580d4a313df4b37f32"},
@@ -3895,7 +3868,3 @@ yubiotp = [
     {file = "YubiOTP-1.0.0.post1-py2.py3-none-any.whl", hash = "sha256:7ad57011866e0bc6c6d179ffbc3926fcc0e82d410178a6d01ba4da0f88332878"},
     {file = "YubiOTP-1.0.0.post1.tar.gz", hash = "sha256:c13825f7b76a69afb92f19521f4dea9f5031d70f45123b505dc2e0ac03132065"},
 ]
-zipp = [
-    {file = "zipp-3.4.1-py3-none-any.whl", hash = "sha256:51cb66cc54621609dd593d1787f286ee42a5c0adbb4b29abea5a63edc3e03098"},
-    {file = "zipp-3.4.1.tar.gz", hash = "sha256:3607921face881ba3e026887d8150cca609d517579abe052ac81fc5aeffdbd76"},
-]
diff --git a/pyproject.toml b/pyproject.toml
index d938e3e89ce2d2b6330b818518a3f3dde74a5edc..03b6facc834739492d121d7b0b5fbfed5a281582 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -33,7 +33,7 @@ url = "https://edugit.org/api/v4/projects/461/packages/pypi/simple"
 secondary = true
 
 [tool.poetry.dependencies]
-python = "^3.7"
+python = "^3.9"
 Django = "^3.2"
 django-any-js = "^1.1"
 django-debug-toolbar = "^3.2"
@@ -99,6 +99,7 @@ django-cleanup = "^5.1.0"
 djangorestframework = "^3.12.4"
 Whoosh = {version = "^2.7.4", optional = true}
 xapian-haystack = {version = "^2.1.1", optional = true}
+django-titofisto = "^0.1.0"
 
 [tool.poetry.extras]
 ldap = ["django-auth-ldap"]