I'm using Djoser for authentication in my Django project, and I've noticed that the default behavior doesn't prevent a user who is already logged in from logging in again, nor does it prevent logged-in users from creating new accounts. Is this the expected behavior, or is there something I might be missing?