authtoken abstract if not installed.

Fixes #705.

docs/topics/release-notes.md

@@ -43,6 +43,7 @@ You can determine your currently installed version using `pip freeze`:
 ### Master
 
 * Filtering backends are now applied to the querysets for object lookups as well as lists.  (Eg you can use a filtering backend to control which objects should 404)
+* Bugfix: Workaround for Django bug causing case where `Authtoken` could be registered for cascade delete from `User` even if not installed.
 
 ### 2.2.3
 

rest_framework/authtoken/models.py

@@ -2,6 +2,7 @@ import uuid
 import hmac
 from hashlib import sha1
 from rest_framework.compat import User
+from django.conf import settings
 from django.db import models
 
 
@@ -13,6 +14,14 @@ class Token(models.Model):
     user = models.OneToOneField(User, related_name='auth_token')
     created = models.DateTimeField(auto_now_add=True)
 
+    class Meta:
+        # Work around for a bug in Django:
+        # https://code.djangoproject.com/ticket/19422
+        #
+        # Also see corresponding ticket:
+        # https://github.com/tomchristie/django-rest-framework/issues/705
+        abstract = 'rest_framework.authtoken' not in settings.INSTALLED_APPS
+
     def save(self, *args, **kwargs):
         if not self.key:
             self.key = self.generate_key()