do you need to test `request.method == 'GET'` here anymore ? you do it already in `has_permission()` and `has_object_permission()`