Currently auth is checked per view by: ``` permission_classes = (IsAuthenticated,) ``` All endpoints should be protected by default.