def get_permissions(self):
    if self.request.method == 'POST':
        return AllowAny()
    else:
        return IsStaffOrTargetUser()