Merge security fix https://github.com/django/django/commit/d19a27066b2247102e65412aa66917aff0091112