title: How to limit view to authenticated user in Django Rest Framework
body: <p>I have a Django Rest Framework application.
  Authentication is performed through a login method:</p>
  
  <pre><code>def login(self, request):
      user = find_my_user(request)
      user.backend = 'django.contrib.auth.backends.ModelBackend'
      login(request, user)
      return Response({"status": "ok"})
  </code></pre>
  
  <p>Authentication works fin.</p>
  
  <p>I have a ViewSet having a list_route() that need authenticated user to be used.
  Here is the code:</p>
  
  <pre><code>class CommonView(viewsets.ViewSet):
      @list_route()
      @authentication_classes(SessionAuthentication)
      @permission_classes(IsAuthenticated)
      def connected(self, request):
          return Response({"status": "ok"})
  </code></pre>
  
  <p>Even if the user is not authenticated (no session cookie), the action is performed.</p>
  
  <p>As a work around, I've performed it like that :</p>
  
  <pre><code>class CommonView(viewsets.ViewSet):
      @list_route()
      def connected(self, request):
          if request.user.is_authenticated():
              return Response({"status": "ok"})
          else:
              return Response({"status": "ko", "message": "Unauthenticated"})
  </code></pre>
  
  <p>But I feel it could be cleaner, any idea ?</p>