code: def authenticate(username, password, permission=None):
      
      try:
          author = Author.objects.get(
              **{'%s__exact' % Author.USERNAME_FIELD: username})
      except Author.DoesNotExist:
          raise Fault(LOGIN_ERROR, _('Username is incorrect.'))
      if not author.check_password(password):
          raise Fault(LOGIN_ERROR, _('Password is invalid.'))
      if not author.is_staff or not author.is_active:
          raise Fault(PERMISSION_DENIED, _('User account unavailable.'))
      if permission:
          if not author.has_perm(permission):
              raise Fault(PERMISSION_DENIED, _('User cannot %s.') % permission)
      return author
docs: Authenticate staff_user with permission.