def deactivate(self, request, *args, **kwargs):
        # django-rest-framework doesn't automatically do this for logged out requests
        SessionAuthentication().enforce_csrf(request)

        request.session.pop('changeset', None)
        request.session['direct_editing'] = False

        return Response({
            'success': True,
        })