tomchristie/django-rest-framework — pull request #187 by sebastibe (2012-03-17 11:33:26+00:00)
Title: Replace 403 by 401 error in permissions.IsAuthenticated

A 403 error response indicates that the client's request is formed correctly, but the REST API refuses to honor it. A 403 response is not a case of insufficient client credentials; that would be 401 ("Unauthorized").

403 should only be used to enforce application-level permissions.