'Users should only be allowed to create data for themselves.'

def test_create_permissions(self):

    url = reverse('api_experiments:v0:data-list')
    response = self.client.post(url, {})
    self.assertEqual(response.status_code, 401)
    user = UserFactory()
    data = {'experiment_id': 1, 'key': 'foo', 'value': 'bar'}
    self.client.login(username=user.username, password=UserFactory._DEFAULT_PASSWORD)
    response = self.client.post(url, data)
    self.assertEqual(response.status_code, 201)
    ExperimentData.objects.get(user=user)
    other_user = UserFactory()
    data['user'] = other_user.username
    response = self.client.post(url, data)
    self.assertEqual(response.status_code, 403)
    self.assertFalse(ExperimentData.objects.filter(user=other_user).exists())
    user.is_staff = True
    user.save()
    response = self.client.post(url, data)
    self.assertEqual(response.status_code, 201)
    ExperimentData.objects.get(user=other_user)
