title: What's the differences between has_object_permission and has_permission?
body: <p>I am confused with the <code>BasePermission</code> in Django-rest-framework.</p>
  <p>Here I defined a class: <code>IsAuthenticatedAndOwner</code>.</p>
  <pre><code>class IsAuthenticatedAndOwner(BasePermission):
      message = 'You must be the owner of this object.'
      def has_permission(self, request, view):
          print('called')
          return False
      def has_object_permission(self, request, view, obj):
          # return obj.user == request.user
          return False
  </code></pre>
  <p>Using in <code>views.py</code></p>
  <pre><code>class StudentUpdateAPIView(RetrieveUpdateAPIView):
      serializer_class = StudentCreateUpdateSerializer
      queryset = Student.objects.all()
      lookup_field = 'pk'
      permissions_classes = [IsAuthenticatedAndOwner]
  </code></pre>
  <p>But it doesn't work at all. Everyone can pass the permission and update the data.</p>
  <p>The <code>called</code> wasn't printed.</p>
  <hr />
  <p>And I used to define this class: <code>IsNotAuthenticated</code></p>
  <pre><code>class IsNotAuthenticated(BasePermission):
      message = 'You are already logged in.'
      def has_permission(self, request, view):
          return not request.user.is_authenticated()
  </code></pre>
  <p>It works well in the function</p>
  <pre><code>class UserCreateAPIView(CreateAPIView):
      serializer_class = UserCreateSerializer
      queryset = User.objects.all()
      permission_classes = [IsNotAuthenticated]
  </code></pre>
  <p>So, what are the differences between the examples above, and function <code>has_object_permission</code> &amp; <code>has_permission</code>?</p>