title: How do I set permissions for POST requests in Django REST Framework?
body: <p>I've got two Django models that are linked like this:</p>
  
  <pre><code>class ParentModel(models.Model):
      creator = models.ForeignKey(User, related_name='objects')
      name = models.CharField(max_length=40)
  
  class ChildModel(models.Model):
      parent = models.ForeignKey(ParentModel, related_name='child_objects')
      name = models.CharField(max_length=40)
  </code></pre>
  
  <p>Now, when making ViewSet for child model, I want it to be created only if its parent was created by the same user that is creating child instance. The permission class that I'm including into my <code>ChildViewSet(viewsets.ModelViewSet)</code> looks like this:</p>
  
  <pre><code>class IsOwner(permissions.BasePermission):
      def has_object_permission(self, request, view, obj):
          if request.method in permissions.SAFE_METHODS:
              return True
          return obj.parent.creator == request.user
  </code></pre>
  
  <p>This seems to work just fine when i use <code>PATCH</code> method, but <code>POST</code> methods don't seem to notice this permission class even when I explicitly set <code>return False</code> for <code>POST</code> method.</p>
  
  <p>What am I doing wrong and how to fix it?</p>