'Returns true if the current request is by the user themselves.
Note: a 404 is returned for non-staff instead of a 403. This is to prevent
users from being able to detect the existence of accounts.'

def has_permission(self, request, view):

    url_username = request.parser_context.get('kwargs', {}).get('username', '')
    if (request.user.username.lower() != url_username.lower()):
        if request.user.is_staff:
            return False
        raise Http404()
    return True
