Token expiration functionality

- [x] Log the user out after X time of inactivity
- [x] Auth tokens should be expired by system
Do you think it's worth extending `rest_framework.authtoken.models.Token` as it looks like it could be an abstract class if `'rest_framework.authtoken'` is not ins `settings.INSTALLED_APPS`

see https://github.com/tomchristie/django-rest-framework/blob/650a91ac24cbd3e5b4ad5d7d7c6706fdf6160a78/rest_framework/authtoken/models.py#L28