title: How can i make django-rest-framework-jwt return token on registration?
body: <p>I have a basic django rest service, which </p>
  
  <ol>
  <li>registers a person and </li>
  <li>updates his password.</li>
  </ol>
  
  <p>I want to add jwt authentication on top of it. If I follow the tutorial I would need to add a new url named "api-token-auth" in project's urls.py. But, I don't want to add this new url and want my register call to send a token in response.</p>
  
  <p>Here's my code:</p>
  
  <p>serializers.py</p>
  
  <pre><code>class UserSerializer(serializers.HyperlinkedModelSerializer):
      def create(self, validated_data):
          user = User(
              username=validated_data['username']
          )
          user.set_password(validated_data['password'])
          user.save()
          return user
  
      def update(self, instance, validated_data):
          instance.set_password(validated_data['password'])
          instance.save()
          return instance
  
      class Meta:
          model = User
          fields = ('url', 'username', 'password')
          lookup_field = 'username'
          write_only_fields = ('password',)
  </code></pre>
  
  <p>views.py</p>
  
  <pre><code>class UserViewSet(viewsets.ModelViewSet):
      """
      API endpoint that allows users to be viewed or edited.
      """
      queryset = User.objects.exclude(is_superuser=1)
      serializer_class = UserSerializer
      lookup_field = 'username'
  </code></pre>
  
  <ol>
  <li>What should be done to achieve this ? should I call api-auth-token inside my serializer's create method ?</li>
  <li>How does django-rest-framework-jwt handles multiple authentication tokens and correctly identifies which token belongs to which user ? Especially when it doesn't store tokens in a db.</li>
  <li>How can I use this authentication mechanism to limit my user to view/update/delete only his user ?</li>
  <li>How can I use this authentication mechanism to do anything in general. For instance if a user wants to write his name to /tmp/abcd.txt. How can I make sure that only authenticated users would be able to do so ?</li>
  <li>Are there any potential loopholes in this approach. Should I use the same code if my app is going to store lots of classified data ?</li>
  </ol>