dont slice username, could be None and not slicing works fine
log auth failures on empty username or password, simplify control flow
get maxlength for LoginAttempt's username column from django's user model