code: def authenticate_user(self, request, user):
          
          return user.check_password(request.data.get('password')) or \
                 self.check_user_token(request, user)
docs: returns ``True`` if the password value supplied is
          a valid user password or a valid user token
          can be overridden to implement more complex checks