title: Require authorization for all but the listing view in a viewset
body: <p>I have a <code>ViewSet</code> called <code>BuildViewSet</code>, with a bunch of detail views and one list view:</p>
  
  <pre><code>class BuildViewSet(viewsets.ModelViewSet):
      queryset = Build.objects.all()
  
      def list(self, request):
          # Do some filtering on self.queryset based on user preferences
  
          return super(BuildViewSet, self).list(request)
  
      @detail_route(methods=['post'])
      def transition(self, request):
          …
  
      # And a bunch of other methods, all prefixed with @detail_route
  </code></pre>
  
  <p>I set up REST Framework so the default authorization class is <code>rest_framework.permissions.IsAuthenticated</code>:</p>
  
  <pre><code>REST_FRAMEWORK = {
      'DEFAULT_AUTHENTICATION_CLASSES': (
          'rest_framework.authentication.TokenAuthentication',
      ),
      'DEFAULT_PERMISSION_CLASSES': (
          'rest_framework.permissions.IsAuthenticated',
      ),
  }
  </code></pre>
  
  <p>However, I want my <code>list()</code> view to be available for everyone, even unauthenticated. I tried changing my <code>list()</code> method like this:</p>
  
  <pre><code>@list_route(permission_classes=(AllowAny,))
  def list(self, request):
      …
  </code></pre>
  
  <p>But this seems to have no effect:</p>
  
  <pre><code>AppError: Bad response: 401 UNAUTHORIZED (not 200 OK or 3xx redirect for http://localhost/api/v1/builds/)
  '{"detail":"Authentication credentials were not provided."}
  </code></pre>
  
  <p>Changing the <code>@detail_route</code> to <code>@permission_classes</code> like this gives the same result:</p>
  
  <pre><code>@permission_classes((AllowAny,))
  def list(self, request):
      …
  </code></pre>
  
  <p>So it seems that <code>list_route(…)</code> is not the way to go, but in this case, what is?</p>