title: Django rest framework permission_classes of ViewSet method
body: <p>I'm writing a rest API with the Django REST framework, and I'd like to protect certain endpoints with permissions. The permission classes look like they provide an elegant way to accomplish this. My problem is that I'd like to use different permission classes for different overridden ViewSet methods.</p>
  
  <pre><code>class UserViewSet(viewsets.ModelViewSet):
      queryset = User.objects.all()
      serializer_class = UserSerializer
  
      def create(self, request, *args, **kwargs):
          return super(UserViewSet, self).create(request, *args, **kwargs)
  
      @decorators.permission_classes(permissions.IsAdminUser)
      def list(self, request, *args, **kwargs):
          return super(UserViewSet, self).list(request, *args, **kwargs)
  </code></pre>
  
  <p>In the code above I'd like to allow registration (user creation) for unauthenticated users too, but I don't want to let list users to anyone, just for staff.</p>
  
  <p>In the <a href="http://www.django-rest-framework.org/api-guide/permissions/" rel="noreferrer">docs</a> I saw examples for protecting API views (not ViewSet methods) with the <code>permission_classes</code> decorator, and I saw setting a permission classes for the whole ViewSet. But it seems not working on overridden ViewSet methods. Is there any way to only use them for certain endpoints? </p>