code: def authenticate(self, request):
          
          # Get the underlying HttpRequest object
          request = request._request  # pylint: disable=protected-access
          user = getattr(request, 'user', None)
  
          # Unauthenticated, CSRF validation not required
          # This is where regular `SessionAuthentication` checks that the user is active.
          # We have removed that check in this implementation.
          # But we added a check to prevent anonymous users since we require a logged-in account.
          if not user or user.is_anonymous:
              return None
  
          self.enforce_csrf(request)
  
          # CSRF passed with authenticated user
          return (user, None)
docs: Authenticate the user, requiring a logged-in account and CSRF.
  
          This is exactly the same as the `SessionAuthentication` implementation,
          with the `user.is_active` check removed.
  
          Args:
              request (HttpRequest)
  
          Returns:
              Tuple of `(user, token)`
  
          Raises:
              PermissionDenied: The CSRF token check failed.