Document limitations of django.contrib.auth

[Aymeric Augustin]

django.contrib.auth aims to be very generic and doesn't provide some features commonly found in web authentication systems:

• password strength checking: requirements depend very much on the context.
• throttling of login attempts: possible with a custom auth backend, for example ​https://github.com/brutasse/django-ratelimit-backend (I haven't audited that code)
• external auth providers: possible with a custom auth backend, there are several third-party apps providing this feature.

The documentation should point out that these features aren't implemented to raise awareness.

[Aymeric Augustin]

Typo: "implmented". Otherwise that looks good!

[Tim Graham <timograham@…>]

In afa3e1633431137f4e76c7efc359b579f4d9c08e:

Fixed #19743 - Documented some limitations of contrib.auth.

Thanks Aymeric for the suggestion.

[Tim Graham <timograham@…>]

In 3b952123ac29f66371f5c51a00026faf7cb945c1:

[1.5.x] Fixed #19743 - Documented some limitations of contrib.auth.

Thanks Aymeric for the suggestion.

Backport of afa3e16334 from master

[Tim Graham <timograham@…>]

In 3b952123ac29f66371f5c51a00026faf7cb945c1:

[1.5.x] Fixed #19743 - Documented some limitations of contrib.auth.

Thanks Aymeric for the suggestion.

Backport of afa3e16334 from master