API clients must call Auth.login which sets the Django session cookie. Which is then inspected/understood by existing middleware which sets request.user!
django_login_required()
permissions_required()