title: DRF and Token authentication with safe-deleted users?
body: <p>I'm using a Django package named <a href="https://github.com/makinacorpus/django-safedelete/" rel="nofollow noreferrer">django-safedelete</a> that allows to delete users without removing them from the database.</p>
  
  <p>Basically, it adds a <code>delete</code> attribute to the model, and the queries like <code>User.objects.all()</code> won't return the deleted models.</p>
  
  <p>You can still query all objects using a special manager. For example <code>User.objects.all_with_deleted()</code> will return all users , including the deleted ones. <code>User.objects.deleted_only()</code> will return the deleted ones.</p>
  
  <p>This works as expected, except in one case.
  I'm using Token Authentication for my users with Django Rest Framework 3.9, and in my DRF views, I'm using the built-in permission <code>IsAuthenticated</code>.</p>
  
  <h3>Code of a basic CBV I'm using:</h3>
  
  <pre><code>class MyView(APIView):
  
      permission_classes = (IsAuthenticated,)
  
      def get(self, request):
          return Response(status=HTTP_200_OK)
  </code></pre>
  
  <h3>Code of the DRF implementation of <code>IsAuthenticated</code> permission:</h3>
  
  <pre><code>class IsAuthenticated(BasePermission):
      """
      Allows access only to authenticated users.
      """
  
      def has_permission(self, request, view):
          return bool(request.user and request.user.is_authenticated)
  </code></pre>
  
  <h3>The problem</h3>
  
  <p>When a user is soft deleted, he's still able to authenticate using its token.</p>
  
  <p>I'm expecting the user to have a 401 Unauthorized error when he's soft deleted.
  What's wrong?</p>