more authentication rules into core OGViewSetMixin class so OG base class views get auth by default - it needs to be overriden to turn it off