Merge security fix https://github.com/django/django/commit/d3a45e10c8ac8268899999129daa27652ec0da35