tomchristie/django-rest-framework — pull request #1613 by dbrgn (2014-06-02 16:38:07+00:00)
Title: Changed return status for CSRF failures to HTTP 403

By default, Django returns "HTTP 403 Forbidden" responses when CSRF validation failed[1]. CSRF is a case of authorization, not of authentication. Therefore `PermissionDenied` should be raised instead of `AuthenticationFailed`.

This is the CSRF issue as discussed in #1611.

[1] https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#rejected-requests