Sending "Bearer" and "Bearer " resulted in a 500.
Updated test docstring related to missing bearer token.
Merge pull request #1705 from opbeat/master

Sending "Bearer" and "Bearer " resulted in a 500.
Fix #1712 (issue when django-guardian is installed but not configured/used)
Merge remote-tracking branch 'reference/master'
Alter CSRF exemption implementation

The previous implementation of decorating `APIView.dispach` with the
`csrf_exempt` decorator allowed for an easy-to-make mistake where
someone could override the `dispatch` method on a view and inadvertantly
remove the csrf exemption of their api view.

By moving the decoration of the view into the `as_view` logic, it
becomes much more difficult to make this mistake.