title: Django Rest Framework Permissions Conflict
body: <p>I'm having a bit of trouble with understanding the flow of Django Rest Framework authentication and permission.  My <code>REST_FRAMEWORK</code> dict in <code>settings.py</code> is as follows:</p>
  
  <pre><code># Use Django's standard `django.contrib.auth` permissions,
  # or allow read-only access for unauthenticated users.
  'DEFAULT_PERMISSION_CLASSES': [
      'rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly'
  ],
  
  'DEFAULT_AUTHENTICATION_CLASSES': (
  #     # 'rest_framework.authentication.BasicAuthentication',
  #     # 'rest_framework.authentication.SessionAuthentication',
      'rest_framework.authentication.TokenAuthentication',
  ),
  </code></pre>
  
  <p>I now am trying to make it so that only authenticated users can make the <code>users-list</code> or <code>users-detail</code> calls, but I do need unauthenticated users to be able to make calls to <code>users-create</code>.  I have tried the following using <a href="https://github.com/caxap/rest_condition" rel="nofollow"><code>rest_condition</code></a>:</p>
  
  <pre><code>from rest_condition import Or, And, Not
  class UserViewSet(ListOnlyIfAdminMixin, viewsets.ModelViewSet):
      queryset = U.objects.all()
      serializer_class = UserSerializer
      # Would this permission_classes declaration come before or be overridden by
      #   the decorator below?
      # permission_classes = [IsAuthenticated, IsAdminOrTargetUser,]
  
      @permission_classes([Or(Not(IsAuthenticated), IsAdminUser)])
      def create(self, request, *args, **kwargs):
           # stuff
  </code></pre>
  
  <p>But when I try to make a <code>POST</code> request to <code>/api/users</code> with the right information to create a new user, I get back the following:</p>
  
  <pre><code>{
  detail: "Authentication credentials were not provided."
  }
  </code></pre>
  
  <p>Now, obviously authentication credentials couldn't be provided, because the user doesn't have an account or token yet.  What's the way to enable a user to sign up without already requiring credentials?</p>