title: DRF: only Author can create or update the book permission
body: <p>So, I have two simple models:</p>
  
  <pre><code>class User(AbstractUser, models.Model):
      username = models.CharField(
          'Username', max_length=255,
          db_index=True, unique=True
      )
      email = models.EmailField(
          'Email', max_length=255, db_index=True,
          blank=True, null=True, unique=True
      )
  
      objects = UserManager()
  
      USERNAME_FIELD = 'username'
      REQUIRED_FIELDS = ('email', 'password',)
  
  
  class Book(models.Model):
      title = models.CharField(max_length=255)
      author = models.ForeignKey(User, on_delete=models.CASCADE)
  
  </code></pre>
  
  <p>and a serializer like this:</p>
  
  <pre><code>class BookSerializer(serializers.ModelSerializer):
      class Meta:
          model = models.Book
          fields = ['title', 'author']
  
      def validate_author(self, author): # &lt; --- it doesn't work
          if author != serializers.CurrentUserDefault():
              raise serializers.ValidationError(
                  'You cant update other authors book'
              )
  
  
      author = serializers.PrimaryKeyRelatedField(
          default=serializers.CurrentUserDefault(),
          queryset=models.User.objects.all()
      )
  </code></pre>
  
  <p>and a view with some permissions:</p>
  
  <pre><code>class IsAuthorOrReadOnly(permissions.BasePermission):
  
      def has_object_permission(self, request, view, obj):
          if request.method in permissions.SAFE_METHODS:
              return True
          return obj.author == request.user
  
  
  class BookViewSet(viewsets.ModelViewSet):
      queryset = models.Book.objects.all()
      serializer_class = serializers.BookSerializer
      permission_classes = [IsAuthenticatedOrReadOnly &amp; IsAuthorOrReadOnly]
  </code></pre>
  
  <p>So, how can I ensure that a user can get all of the books but can't create or update the books which don't belong to him?</p>