request.user should be still be accessible in renderer context if authentication fails