Fixed failing test introduced by 87d2750b39.

The {% ssi %} tag in Django 1.4 doesn't support spaces in its argument.
Skip the test if run from a location that contains a space.
[1.4.x] Bump version post-release.
Merge pull request #1616 from loic/fix1.4

Fixed failing test introduced by 87d2750b39.
[1.4.x] Fixed #20887 -- Added a warning to GzipMiddleware in light of BREACH.

Thanks EvilDMP for the report and Russell Keith-Magee
for the draft text.

Backport of da843e7dba from master
Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth

Thanks Collin Anderson for the report.

Backport of 425d076d0c from master
[1.4.x] Ensure that passwords are never long enough for a DoS.

 * Limit the password length to 4096 bytes
  * Password hashers will raise a ValueError
  * django.contrib.auth forms will fail validation
 * Document in release notes that this is a backwards incompatible change

Thanks to Josh Wright for the report, and Donald Stufft for the patch.

This is a security fix; disclosure to follow shortly.

Backport of aae5a96d5754ad34e48b7f673ef2411a3bbc1015 from master.
[1.4.x] Add release notes and bump version numbers for 1.4.8 security release.
[1.4.x] Removed usage of b"" string syntax for Python 2.5 compatibility.

Refs commit 3f3d887a6844ec2db743fee64c9e53e04d39a368.
Merge tag '1.4.8' into nonrel-1.4

Tag 1.4.8