Logout by deleting auth token on password change

[karthikvrao]

I found that PasswordChangeSerializer has logic that does not update the session_auth_hash if LOGOUT_ON_PASSWORD_CHANGE setting is False, thereby logging out the user after changing password. But it does not do the same for token authentication by deleting the auth token. I had to override the serializer to fix this. If the current behaviour is not by design, below is my fix:

    def save(self):
        self.set_password_form.save()
        if self.logout_on_password_change:
            self.user.auth_token.delete()
        else:
            from django.contrib.auth import update_session_auth_hash
            update_session_auth_hash(self.request, self.user)