title: Restrict update method to only modify request user's own data?
body: <p>I have an Update method in DRF to allow users to update their own profile. The api endpoint is <code>PUT /api/users/{id}/</code> where id is his own user id. If he attempts to update any other users profile he will receive a HTTP403.</p>
  
  <p>The way I am doing it right now is </p>
  
  <pre><code>def update(self, request, *args, **kwargs):
      """
      Update user profile
      """
      if int(kwargs['id']) is not request.user.id:
          return Response({}, status=status.HTTP_403_FORBIDDEN)
      return super(UserViewSet, self).update(request, *args, **kwargs)
  </code></pre>
  
  <p>I am hoping to do this in a more elegant way, perhaps with a decorator or something?</p>