A bit strange that `authentication_classes` is a list and `permission_classes` is a tuple.