code: def has_permission(self, request, view):
          
          url_username = request.parser_context.get('kwargs', {}).get('username', '')
          if request.user.username.lower() != url_username.lower():
              if request.user.is_staff:
                  return False  # staff gets 403
              raise Http404()
          return True
docs: Returns true if the current request is by the user themselves.
  
          Note: a 404 is returned for non-staff instead of a 403. This is to prevent
          users from being able to detect the existence of accounts.