code: def check_auth(self, request):
          
          if not request.user.is_authenticated:
              raise PermissionDenied
          if not is_admin(request):
              raise PermissionDenied
docs: to ensure that nobody can get your data via json simply by knowing the
          URL.  public facing forms should write a custom LookupChannel to
          implement as you wish.  also you could choose to return
          HttpResponseForbidden("who are you?") instead of raising
          PermissionDenied (401 response)