code: def _authenticate(self, request):
          
  
          def ensure_user_obj():
              """ Make sure that request object has user property.
  
              If `request.user` is not present or is `None`, it is
              created and initialized with `AnonymousUser`.
              """
  
              try:
                  if request.user:
                      return
              except AttributeError:
                  pass
  
              request.user = AnonymousUser()
  
          def anonymous_access(exc_obj):
              """ Determine what to do with unauthenticated requests.
  
              If the request has already been authenticated, does
              nothing.
  
              :param exc_obj: exception object to be thrown if anonymous
              access is not permitted.
              """
  
              if request.user and request.user.is_authenticated():
                  # request is already authenticated
                  pass
              elif self.allow_anonymous:
                  request.user = AnonymousUser()
              else:
                  raise exc_obj
  
          # first, make sure that the request carries `user` attribute
          ensure_user_obj()
          if self.authentication:
              # authentication handler is configured
              try:
                  self.authentication.authenticate(request)
              except errors.Unauthorized, exc:
                  # http request doesn't carry any authentication information
                  anonymous_access(exc)
          else:
              # no authentication configured
              anonymous_access(errors.Forbidden())
docs: Perform authentication.