Login failures should be logged

[Jacob Kaplan-Moss]

Login failures [*] should emit logging messages. There are a couple of good reasons for this:

• Many compliance regimes (all those deriving from NIST-800-53, so FISMA, PCI, HIPAA, etc) require logging of failed login attempts.
• It'll makes integration with a SIEM easier out of the box.

[*] we may want to log successes, too, or have a configuration option or somesuch. I tend to think successes are noise, but reasonable people disagree on that point.

[One of a series of bugs from a discussion I had with @mallyvai about improving the security of Django's admin - see ​https://gist.github.com/mallyvai/bcb0bb827d6d53212879dff23cf15d03 for the full list.]

[Tim Graham]

Duplicate of #20495. Feel free to continue the discussion there and reopen if you feel my closing was in error.

[Vaibhav Mallya]

Unsure about correct process, but I reopened the original ticket. Should I set that to New instead?

[Tim Graham]

I replied on the other ticket.