  class UserLoggedInAuthenticator(BaseAuthenticator):
      """Use Djagno's built-in request session for authentication."""
      def authenticate(self, request):
          if getattr(request, 'user', None) and request.user.is_active:
              # Temporarily request.POST with .RAW_CONTENT, so that we use our more generic request parsing
              request._post = self.mixin.RAW_CONTENT
              resp = CsrfViewMiddleware().process_view(request, None, (), {})
              del(request._post)
              if resp is None:  # csrf passed
                  return request.user
          return None
 
</s> remove     """Use Djagno's built-in request session for authentication."""
 </s> add     """Use Django's built-in request session for authentication.""" </s> remove             # Authenticate the request, and store any context so that the resource operations can
            # do more fine grained authentication if required.
 </s> add             self.request = request
            self.args = args
            self.kwargs = kwargs
    
            # Calls to 'reverse' will not be fully qualified unless we set the scheme/host/port here.
            prefix = '%s://%s' % (request.is_secure() and 'https' or 'http', request.get_host())
            set_script_prefix(prefix)
    
            try:
                # If using a form POST with '_method'/'_content'/'_content_type' overrides, then alter
                # self.method, self.content_type, self.RAW_CONTENT & self.CONTENT appropriately.
                self.perform_form_overloading()
    
                # Authenticate and check request is has the relevant permissions
                self.check_permissions()
    
                # Get the appropriate handler method
                if self.method.lower() in self.http_method_names:
                    handler = getattr(self, self.method.lower(), self.http_method_not_allowed)
                else:
                    handler = self.http_method_not_allowed
    
                response_obj = handler(request, *args, **kwargs)
    
                # Allow return value to be either Response, or an object, or None
                if isinstance(response_obj, Response):
                    response = response_obj
                elif response_obj is not None:
                    response = Response(status.HTTP_200_OK, response_obj)
                else:
                    response = Response(status.HTTP_204_NO_CONTENT)
    
                # Pre-serialize filtering (eg filter complex objects into natively serializable types)
                response.cleaned_content = self.cleanup_response(response.raw_content)
    
            except ErrorResponse, exc:
                response = exc.response
    
            # Always add these headers. </s> remove             # Typically the context will be a user, or None if this is an anonymous request,
            # but it could potentially be more complex (eg the context of a request key which
            # has been signed against a particular set of permissions)
            auth_context = self.auth

            # If using a form POST with '_method'/'_content'/'_content_type' overrides, then alter
            # self.method, self.content_type, self.CONTENT appropriately.
            self.perform_form_overloading()

            # Ensure the requested operation is permitted on this resource
            self.check_method_allowed(self.method, auth_context)

            # Get the appropriate create/read/update/delete function
            func = getattr(self, self.callmap.get(self.method, None))
 </s> add             # TODO - this isn't actually the correct way to set the vary header,
            # also it's currently sub-obtimal for HTTP caching - need to sort that out. 
            response.headers['Allow'] = ', '.join(self.allowed_methods)
            response.headers['Vary'] = 'Authenticate, Accept' </s> remove     anon_allowed_methods = ('GET',)
 </s> add     permissions = () </s> remove             # Either generate the response data, deserializing and validating any request data
            # TODO: This is going to change to: func(request, *args, **kwargs)
            # That'll work out now that we have the lazily evaluated self.CONTENT property.
            response_obj = func(request, *args, **kwargs)

            # Allow return value to be either Response, or an object, or None
            if isinstance(response_obj, Response):
                response = response_obj
            elif response_obj is not None:
                response = Response(status.HTTP_200_OK, response_obj)
            else:
                response = Response(status.HTTP_204_NO_CONTENT)

            # Pre-serialize filtering (eg filter complex objects into natively serializable types)
            response.cleaned_content = self.cleanup_response(response.raw_content)

        except ErrorResponse, exc:
            response = exc.response

        # Always add these headers.
        #
        # TODO - this isn't actually the correct way to set the vary header,
        # also it's currently sub-obtimal for HTTP caching - need to sort that out. 
        response.headers['Allow'] = ', '.join(self.allowed_methods)
        response.headers['Vary'] = 'Authenticate, Accept'

        return self.emit(response)
 </s> add             return self.emit(response)
        except:
            import traceback
            traceback.print_exc()
            # Temporarily set request.POST to view.RAW_CONTENT,
            # so that we use our more generic request parsing,
            # in preference to Django's form-only request parsing.
            request._post = self.view.RAW_CONTENT
  class UserLoggedInAuthenticator(BaseAuthenticator):
      """Use Djagno's built-in request session for authentication."""
      def authenticate(self, request):
          if getattr(request, 'user', None) and request.user.is_active:
            # Temporarily set request.POST to view.RAW_CONTENT,
            # so that we use our more generic request parsing,
            # in preference to Django's form-only request parsing.
            request._post = self.view.RAW_CONTENT
            # Temporarily set request.POST to view.RAW_CONTENT,
            # so that we use our more generic request parsing,
            # in preference to Django's form-only request parsing.
            request._post = self.view.RAW_CONTENT
              resp = CsrfViewMiddleware().process_view(request, None, (), {})
              del(request._post)
              if resp is None:  # csrf passed
                  return request.user
          return None
keep keep keep keep replace replace keep keep keep keep keep
 Generic permissions added, allowed_methods and anon_allowed_methods now defunct, dispatch now mirrors View.dispatch more nicely 
djangorestframework/authenticators.py