code: def check_user_token(self, request, user):
          
          if not app_settings.REST_USER_TOKEN_ENABLED:
              return False
          try:
              token = Token.objects.get(
                  user=user,
                  key=request.data.get('password')
              )
          except Token.DoesNotExist:
              token = None
          else:
              if app_settings.DISPOSABLE_USER_TOKEN:
                  token.delete()
          finally:
              return token is not None
docs: if user has no password set and has at least 1 social account
          this is probably a social login, the password field is the
          user's personal auth token