Explain why login_required is not applied to views

For some (including me) it might be confusing why certain views are not
protected by login_required. Add comments explaining why it is the case.
Bug: changing protection was not login protected

Anonymous users can see the change password screen when manually
accessing URL /accounts/change-password/

When the form is submitted NotImplementedError is raised.

Solved by wrapping in login_required() decorator.
Enforce changing password follow password rules

During the registration and in dashboard, the new password is required
to have min 6 characters and not be in common passwords. Those rules are
not enforced when changing password in the account section or resetting
password.

Extract password validators into core validators as they are used by
multiple apps. `password_validators` now contains all validators applied
to passwords: DRY principle.

Changed auth tests to have a proper password for password reset.
Use Oscar partial for the form
Clean password reset forms
Use Profile.DoesNotExists

It makes code a little bit more readable
Merge pull request #1202

Conflicts:
	oscar/app.py
	oscar/apps/customer/app.py
	oscar/apps/customer/forms.py
	oscar/apps/dashboard/partners/forms.py
Add issue #1202 to v0.7 release notes
Merge branch 'releases/0.7' of github.com:tangentlabs/django-oscar into releases/0.7
Add num_approved_reviews property to product model

This allows a more elegant way of avoiding unnecessary SQL queries when
looking up the number of reviews in templates.

This was spotted while investigating (and fixing) #1299. This
highlighted that the add-reviews view was not passing the reviews_count
variable which had been introduced in 9d75db402. For some reason, this
failed silently in using the en-gb locale but died noisily with
TypeError for ru and others.
Merge branch 'releases/0.7' of github.com:tangentlabs/django-oscar into releases/0.7