Employment application requires Django login

[stellanl]

Test plan

GIVEN the /rest/v1/user/../request_organisation/ endpoint
WHEN POSTing a request from outside of RSR
AND the correct authentication details are provided
THEN the request should be process accordingly, instead trying to authenticate through Django's auth system

Issue description

Just as for #2037, when posting a request for employment to the /rest/v1/user/request_organisation/ endpoint, a Django login is required, which is not the case for the rest of the API; an API key should be sufficient.

[stellanl]

This does not seem to work right. Looks like access is checked against anonymous user when not logged into Django; the API key is never checked.

[stellanl]

Interestingly, in project_update.py, for POST, there is a @permission_classes((IsAuthenticated, )) and that endpoint works from Up. Maybe some of the API key logic I just committed could be used there, too.

[zzgvh]

I think we should review the @api_view(['POST']) endpoints, and add the @authentication_classes decorator to eliminate unauthenticated access. I think the enpoints used by Up should have
@authentication_classes([TastyTokenAuthentication, SessionAuthentication]) and the others only @authentication_classes([SessionAuthentication]).

If I understand correctly, valid authentication sets request.user to the authenticated user, as seen in the commit above, so it becomes very easy to know who's calling. But that brings me to wonder if the PK of the user is needed?

[stellanl]

How are the authentication classes combined? With OR or AND?

[zzgvh]

I think they are tested against in order until you're either authenticated or out of methods.