• #424: Added a ROTATE_REFRESH_TOKEN setting to control whether refresh tokens are reused or not
• #315: AuthorizationView does not overwrite requests on get
• #425: Added support for Django 1.10
• #396: added an IsAuthenticatedOrTokenHasScope Permission
• #357: Support multiple-user clients by allowing User to be NULL for Applications
• #389: Reuse refresh tokens if enabled.