title: Why does Django REST Framework provide different Authentication mechanisms
body: <p>Why does Django REST Framework implement a different Authentication mechanism than the built-in Django mechanism?</p>
  
  <p>To wit, there are two settings classes that one can configure:</p>
  
  <ol>
  <li><code>settings.AUTHENTICATION_BACKENDS</code> which handles the Django-level authentication, and</li>
  <li><code>settings.REST_FRAMEWORK['DEFAULT_AUTHENTICATION_CLASSES']</code> which authenticates at the REST-Framework level</li>
  </ol>
  
  <p>The problem I'm experiencing is that I have a Middleware layer which checks whether a user is logged-in or not.</p>
  
  <p>When using a web client which authenticates via sessions, this works fine. However, from mobile or when running the test suite (i.e. authenticating using HTTP headers and tokens), the middleware detects the user as an <code>AnonymousUser</code>, but by the time we get to the REST Framework layer, the HTTP <code>Authorization</code> header is read, and the user is logged-in.</p>
  
  <p>Why do these not both happen BEFORE the middleware? Furthermore, why doesn't REST Framework's authentication methods not rely on the Django authentication backend?</p>