Explain why login_required is not applied to views

For some (including me) it might be confusing why certain views are not
protected by login_required. Add comments explaining why it is the case.
Bug: changing protection was not login protected

Anonymous users can see the change password screen when manually
accessing URL /accounts/change-password/

When the form is submitted NotImplementedError is raised.

Solved by wrapping in login_required() decorator.
Enforce changing password follow password rules

During the registration and in dashboard, the new password is required
to have min 6 characters and not be in common passwords. Those rules are
not enforced when changing password in the account section or resetting
password.

Extract password validators into core validators as they are used by
multiple apps. `password_validators` now contains all validators applied
to passwords: DRY principle.

Changed auth tests to have a proper password for password reset.
Use Oscar partial for the form
Clean password reset forms
Use Profile.DoesNotExists

It makes code a little bit more readable
Fix a few lint errors
Fix Sphinx warning from PhonenumberDescriptor docstring
Bump version to 0.7-beta-1
Improve the 0.7 release notes
Ensure email is required in UserAndProfileForm

Previously, despite required attribute was being overwritten when
importing the email fields from the user model.

Fixes #1237
[Backport] Allow unassigning categories from products

This has been impossible so far. It is easily achieved by setting
can_delete=True on the formset.

I spent some time trying to get the nice solution working, which would
be that assigning an empty category means deleting that ProductCategory
instance. But I haven't found a good solution that avoids problems like
in #1267. I have since come to the conclusion that enabling can_delete
is the right thing to do. One can then explicitly hide the checkbox,
but set the correct hidden field in Javascript on the client side if
an empty value is assigned.

The fields section has been moved from the factory declaration to the
ProductForm Meta class to allow for easier customisation.

Fixes #1289

(cherry picked from commit 3e4c2f73ddbbb727597d5d60ddb27f8bbb7bbb93)
Merge pull request #1202

Conflicts:
	oscar/app.py
	oscar/apps/customer/app.py
	oscar/apps/customer/forms.py
	oscar/apps/dashboard/partners/forms.py
Add issue #1202 to v0.7 release notes
Merge branch 'releases/0.7' of github.com:tangentlabs/django-oscar into releases/0.7
Style fix: Don't shadow the built-in by calling a variable object
Alway skip attribute validation for group products

The check was already done for ProductForms, but can fail when saving
products elsewhere. Moved the logic to where validate_products is
called. This currently is the Product's save() method, but really should
live in clean() instead. Will fix shortly.

Fixes #1281
Add num_approved_reviews property to product model

This allows a more elegant way of avoiding unnecessary SQL queries when
looking up the number of reviews in templates.

This was spotted while investigating (and fixing) #1299. This
highlighted that the add-reviews view was not passing the reviews_count
variable which had been introduced in 9d75db402. For some reason, this
failed silently in using the en-gb locale but died noisily with
TypeError for ru and others.
Merge branch 'releases/0.7' of github.com:tangentlabs/django-oscar into releases/0.7
Document work done as part of #1299