  
          reason = CSRFCheck().process_view(http_request, None, (), {})
          if reason:
              # CSRF failed, bail with explicit error message
              raise exceptions.PermissionDenied('CSRF Failed: %s' % reason)
  
          # CSRF passed with authenticated user
          return (user, None)
  
  
 
</s> remove             return
 </s> add             return None </s> remove             self._user, self._auth = self._authenticate()
 </s> add             self._authenticator, self._user, self._auth = self._authenticate() </s> remove             if token.user.is_active:
                return (token.user, token)
 </s> add  </s> remove         if len(auth) == 2 and auth[0].lower() == "token":
            key = auth[1]
            try:
                token = self.model.objects.get(key=key)
            except self.model.DoesNotExist:
                return None
 </s> add         if not auth or auth[0].lower() != "token":
            return None

        if len(auth) != 2:
            raise exceptions.AuthenticationFailed('Invalid token header')

        return self.authenticate_credentials(auth[1])

    def authenticate_credentials(self, key):
        try:
            token = self.model.objects.get(key=key)
        except self.model.DoesNotExist:
            raise exceptions.AuthenticationFailed('Invalid token')

        if token.user.is_active:
            return (token.user, token)
        raise exceptions.AuthenticationFailed('User inactive or deleted')

    def authenticate_header(self):
        return 'Token'
            raise exceptions.AuthenticationFailed('CSRF Failed: %s' % reason)
  
          reason = CSRFCheck().process_view(http_request, None, (), {})
          if reason:
              # CSRF failed, bail with explicit error message
            raise exceptions.AuthenticationFailed('CSRF Failed: %s' % reason)
  
          # CSRF passed with authenticated user
          return (user, None)
  
  
keep keep keep keep replace keep keep keep keep keep
 Implementing 401 vs 403 responses 
rest_framework/authentication.py