Do we still want to enforce Django model permissions? Then we can create tokens but still have fine-grained control over permissions for users.