Executing AutocompleteWidget.callback() from AutocompleteWidget constructor is a bad idea. When you instantiate the factory class in a model file, the callback will become exposed from every page in your application. The callback should be executed from AutocompleteWidget.__call__() so that it'll be subject to the same access control restrictions as its parent form.