expired url_auth_token does not raise PermissionDenied about django-sesame HOT 3 CLOSED

https://docs.djangoproject.com/en/2.2/topics/auth/customizing/#writing-an-authentication-backend says:

authenticate() should check the credentials it gets and return a user object that matches those credentials if the credentials are valid. If they’re not valid, it should return None.

Raising an exception isn't part of the API contract.

from django-sesame.

One solution would be to detect when the user attempted to authenticate with a token and not to redirect to the login page in that case.

from django-sesame.

You're right, in https://docs.djangoproject.com/en/2.2/topics/auth/customizing/#handling-authorization-in-custom-backends I read
"If a backend raises a PermissionDenied exception in has_perm() or has_module_perms(), the authorization will immediately fail and Django won’t check the backends that follow." And so thought about a permissiondenied but it is about authorization, not really authentication.

from django-sesame.