enforce csrf in editor api and make it usuable offline

src/c3nav/editor/api.py

@@ -4,6 +4,7 @@ from django.db.models import Prefetch, Q
 from django.urls import Resolver404, resolve
 from django.utils.functional import cached_property
 from django.utils.translation import ugettext_lazy as _
+from rest_framework.authentication import SessionAuthentication
 from rest_framework.decorators import action
 from rest_framework.exceptions import NotFound, PermissionDenied, ValidationError
 from rest_framework.generics import get_object_or_404
@@ -279,10 +280,8 @@ class EditorViewSet(ViewSet):
         raise AttributeError
 
     def post_or_delete(self, request, *args, **kwargs):
-        # Django REST Framework does only check csrf on logged in requests.
+        # django-rest-framework doesn't automatically do this for logged out requests
-        # So let's make the entire writable c3nav API require a login.
+        SessionAuthentication().enforce_csrf(request)
-        if not request.user.is_authenticated:
-            raise PermissionDenied(_('Login required.'))
 
         return self.retrieve(request, *args, **kwargs)