Could probably be in its own `permission` or `authentication` module to help discoverability. Maybe even in something like `apps.api.base`