tomchristie/django-rest-framework — pull request #1896 by dbrgn (2014-09-23 12:17:50+00:00)
Title: Changed return status for CSRF failures to HTTP 403

By default, Django returns "HTTP 403 Forbidden" responses when CSRF
validation failed[1]. CSRF is a case of authorization, not of
authentication. Therefore `PermissionDenied` should be raised instead
of `AuthenticationFailed`.

This replaces pull request #1613.

[1] https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#rejected-requests