The fact that we don't import Token from authentication doesn't invalidate
the need for the model to be abstract whenever the authtoken isn't listed
in the INSTALLED_APPS.