DRF: How to password protect the DefaultRouter

Question

How would you go about protecting DefaultRouter() so the user can not view API Root unless they are logged in?

class OrderViewSet(viewsets.ReadOnlyModelViewSet):
    permission_classes = (permissions.IsAuthenticated)
    queryset = Order.objects.all()
    serializer_class = OrderSerializer

router = routers.DefaultRouter()
router.register(r'orders', views.OrderViewSet)

urlpatterns = [
    url(r'^', include(router.urls)),
    url(r'^auth/', include('rest_framework.urls')),
]  

project.urls.py

# API
url(r'^api/', include(api_urls)),

Answer 1

You can add default permission classes in your settings.py file:

REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
    )
}