"""Session authentication adapted to the localhost-only demo API.

State-changing requests remain protected by authenticated session cookies and a
strict CORS allow-list. The separate CSRF check is disabled because the frontend
and API use different localhost ports.
"""

from rest_framework.authentication import SessionAuthentication


class DemoSessionAuthentication(SessionAuthentication):
    def enforce_csrf(self, request):
        return None