code: def start(self, request, application, extra_roles=None):
          
          # Get the authentication of the current user
          roles = self._get_roles_for_request(request, application)
          if extra_roles is not None:
              roles.update(extra_roles)
  
          # Ensure current user is authenticated. If user isn't applicant,
          # leader, delegate or admin, they probably shouldn't be here.
          if 'is_authorised' not in roles:
              return HttpResponseForbidden('<h1>Access Denied</h1>')
  
          # Go to first state.
          return self._next(request, application, roles, self._first_state)
docs: Continue the state machine at first state.