'Authenticate the user, requiring a logged-in account and CSRF.
This is exactly the same as the `SessionAuthentication` implementation,
with the `user.is_active` check removed.
Args:
request (HttpRequest)
Returns:
Tuple of `(user, token)`
Raises:
PermissionDenied: The CSRF token check failed.'

def authenticate(self, request):

    request = request._request
    user = getattr(request, 'user', None)
    if ((not user) or user.is_anonymous()):
        return None
    self.enforce_csrf(request)
    return (user, None)
