Many many things:
1) Serializer for Backups finally working, accepting file uploads through request.FILES['file'] and downloads through request.GET['file format'] == 'raw'
2) Forbid regular user to update/patch another user information
3) PrivateModelViewSet => PrivateModelMixin for object level user filtering
4) Added Mixin granularity in BackupViewSet to control actions. Only GET (retrieve/list) and POST (create) must be available
5) Removed many to many from Users to Destinations