dont slice username, could be None and not slicing works fine, fixes #1
log auth failures on empty username or password, simplify control flow, fixes #3
get maxlength for LoginAttempt's username column from django's user model
dont log bad attempt on empty form submissions
disable expired users before calling authenticate, fixes #8