title: You do not have permission to perform this action when accessing api in django
body: <p>i am trying to add custom permissions in my Django app using Django rest framework. i created an API n tested it in postman it works fine for authenticated user. however it doesnt display details when i visit details view . for example when i visit <a href="http://localhost:8000/placeslist/" rel="noreferrer">http://localhost:8000/placeslist/</a> it displays all the places but when i try <a href="http://localhost:8000/placeslist/1/" rel="noreferrer">http://localhost:8000/placeslist/1/</a> it says you dont have permission. i dont know where i went wrong </p>
  
  <p><strong>models.py</strong></p>
  
  <pre><code>class Places(BaseModel):
    name = models.CharField(max_length=255,null=True,default='')
    owner=models.ForeignKey('auth.User',related_name='place_list',on_delete=models.CASCADE,null=True)    
  </code></pre>
  
  <p><strong>Views.py</strong></p>
  
  <pre><code>class PlacesView(generics.ListCreateAPIView):
      queryset = Places.objects.all()
      serializer_class = PlacesSerializer
      permission_classes = (permissions.IsAuthenticated, IsOwner)
  
      def perform_create(self,serializer):
        serializer.save(owner=self.request.user)
  
  
  class PlacesDetailView(generics.RetrieveUpdateDestroyAPIView):
      queryset = Places.objects.all()
      serializer_class = PlacesSerializer
      permission_classes = (permissions.IsAuthenticated, IsOwner)
  </code></pre>
  
  <p><strong>Permission.py</strong>    </p>
  
  <pre><code>class IsOwner(BasePermission):
    def has_object_permission(self, request, view, obj):
      if isinstance(obj, Places):
          return obj.owner == request.user       
      return obj.owner == request.user    
  </code></pre>
  
  <p><strong>Serializer.py</strong></p>
  
  <pre><code>class PlacesSerializer(serializers.ModelSerializer):
    owner = serializers.ReadOnlyField(source='owner.username')
    class Meta:
      model = Places
      fields =('id','name','owner')
  </code></pre>
  
  <p><strong>urls.py</strong>    </p>
  
  <pre><code>url(r'^placeslist/$', PlacesView.as_view(), name="place"),
  url(r'placeslist/(?P&lt;pk&gt;[0-9]+)/$',PlacesDetailView.as_view(), 
  name="place_details"),
  url(r'^get-token/', obtain_auth_token),
  </code></pre>
  
  <p><strong>Settings.py</strong></p>
  
  <pre><code>....
  
  REST_FRAMEWORK = {
  'DEFAULT_PERMISSION_CLASSES': (
      'rest_framework.permissions.IsAuthenticated',
  ),
  'DEFAULT_AUTHENTICATION_CLASSES': (
      'rest_framework.authentication.BasicAuthentication',
      'rest_framework.authentication.TokenAuthentication',
  )
  }
  
  ....
  </code></pre>