================
- Only verify the first 4096 characters of a password to prevent
denial-of-service attacks through repeated submission of large
passwords, tying up server resources in the expensive computation
of the corresponding hashes.
See: https://www.djangoproject.com/weblog/2013/sep/15/security/