A new session is created for every request

[emadwill]

Whenever a new request is made to the server using a token, a new Django session is created. It shouldn't matter because sessions are not used here, but it could overwhelm the session store whether that is a database or an in-memory cache. This could be fixed by not calling the login() function in the decorator and setting request.user directly

[jpulgarin]

Thanks for spotting this! Fixed.