Use exceptions.Forbidden, not PermissionDenied
user.is_authenticated is a method, not a property. Call it.