Add note about 'User account is disabled.' vs 'Unable to log in'

rest_framework/authtoken/serializers.py

@@ -16,6 +16,9 @@ class AuthTokenSerializer(serializers.Serializer):
             user = authenticate(username=username, password=password)
 
             if user:
+                # From Django 1.10 onwards the `authenticate` call simply
+                # returns `None` for is_active=False users.
+                # (Assuming the default `ModelBackend` authentication backend.)
                 if not user.is_active:
                     msg = _('User account is disabled.')
                     raise serializers.ValidationError(msg)