Bump django-allauth to 65.3.1

[gounux]

This PR upgrades django-allauth dependency version to a newer one :

• bumps django-allauth to 65.3.1 in requirements
• adds allauth.account.middleware.AccountMiddleware to settings' MIDDLEWARE (see Quickstart guide)
• removes django-axes from the requirements (edit : choice has been made to keep the django-axes rate limiter for the moment, since it provides a convenient way to re-enable a locked-out user, in the admin interface)
• does not add any regression (check authentication module tests as well)

[duke-nyuki]

Task linked: QF-4844 Bump django-allauth to 64.2.1+

[gounux]

Actually, after having removed the axes dependency, the allauth rate limiter makes an alert get displayed, directly in the login page :

allauth's rate limiter doc is here FYI.

Still trying to figure out how to manage to re-enable login after to many failed attempts, switching this PR to WIP.

Edit : am also trying to manage a way to notify and display the user in how many time he/she will be allowed to try again a login. I find this "try again later" not nice :(

[suricactus]

There are still open TODOs in the PR? If they are no longer relevant, please strikethrough them and explain why they are no longer relevant.

[suricactus]

Code looks good. Please squash all in a single commit, do some tests and if all good, it is ready to merge!

[gounux]

Thanks for the review @suricactus !

do some tests and if all good, it is ready to merge!

Actually I have been testing, rate limiter looks fine but after a successful login, there is this error message :

Seems related to the axes compat, maybe I would recommend to proceed like this :

• finalize and merge this PR bumping axes dependency
• merge master into this branch
• bump dependencies again in this branch using pipcompile
• test again

What do you think ?

Maybe next time we could also regroup dependencies bumping into a single PR ?
My bad for this one actually, apologies for the noise

[duke-nyuki]

Task linked: QF-4848 Bump django-axes to 6.0.0+

[suricactus]

Hi, @gounux . You can always change the base of a PR to point not to master, but other specific branch. Hope this helps:

This kind of PRs should ideally be one per dependency with very strict commits and messages related to tme, so they can be easily reverted when needed.