          user = getattr(http_request, 'user', None)
  
          # Unauthenticated, CSRF validation not required
          if not user or not user.is_active:
              return
  
          # Enforce CSRF validation for session based authentication.
          class CSRFCheck(CsrfViewMiddleware):
              def _reject(self, request, reason):
                  # Return the failure reason instead of an HttpResponse
 
</s> remove             raise exceptions.PermissionDenied('CSRF Failed: %s' % reason)
 </s> add             raise exceptions.AuthenticationFailed('CSRF Failed: %s' % reason) </s> remove         if len(auth) == 2 and auth[0].lower() == "token":
            key = auth[1]
            try:
                token = self.model.objects.get(key=key)
            except self.model.DoesNotExist:
                return None
 </s> add         if not auth or auth[0].lower() != "token":
            return None

        if len(auth) != 2:
            raise exceptions.AuthenticationFailed('Invalid token header')

        return self.authenticate_credentials(auth[1])

    def authenticate_credentials(self, key):
        try:
            token = self.model.objects.get(key=key)
        except self.model.DoesNotExist:
            raise exceptions.AuthenticationFailed('Invalid token')

        if token.user.is_active:
            return (token.user, token)
        raise exceptions.AuthenticationFailed('User inactive or deleted')

    def authenticate_header(self):
        return 'Token' </s> remove                 return user_auth_tuple
 </s> add                 user, auth = user_auth_tuple
                return (authenticator, user, auth)
            return None
          user = getattr(http_request, 'user', None)
  
          # Unauthenticated, CSRF validation not required
          if not user or not user.is_active:
            return None
  
          # Enforce CSRF validation for session based authentication.
          class CSRFCheck(CsrfViewMiddleware):
              def _reject(self, request, reason):
                  # Return the failure reason instead of an HttpResponse
keep keep keep keep replace keep keep keep keep keep
 Implementing 401 vs 403 responses 
rest_framework/authentication.py