code: def has_permission(self, request, view):
          
          user_filter = self._get_user_filter(request)
          if not user_filter:
              # no user filters are present in the token to limit access
              return True
  
          username_param = get_username_param(request)
          allowed = user_filter == username_param
          if not allowed:
              log.warning(
                  u"Permission JwtHasUserFilterForRequestedUser: user_filter %s doesn't match username %s.",
                  user_filter,
                  username_param,
              )
          return allowed
docs: If the JWT has a user filter, verify that the filtered
          user value matches the user in the URL.