An auth token for the API is the same as a password for a user.

IMHO it should not be saved plain text in the database, but rather a hash (similar to passwords).

I know that there are other apps that provide that, I think that the minimal implementation that DRF delivers
should be secure (or not being offered) as it is easily used in production causing security flaws