User session management and token expiry
Right now the user gets a token for each login, and the token is not expired. While we can just keep track of the last token and expire all others, that would prevent usage of multiple devices. Keeping a list of sessions/machines (via their User-Agent?) and only allowing the last token for them would be the best option.
Django-rest-knox library provides models and views to handle token based authentication in a more secure and extensible way than the built-in TokenAuthentication scheme - with Single Page Applications and Mobile clients in mind. It provides per-client tokens, and views to generate them when provided some other authentication (usually basic authentication), to delete the token (providing a server enforced logout) and to delete all tokens (logs out all clients that a user is logged into).