replace django.utils.hashcompat with hashlib

The compatibility modules django.utils.copycompat and django.utils.hashcompat as well as the functions django.utils.itercompat.all and django.utils.itercompat.any will be removed. The Python builtin versions should be used instead.

https://docs.djangoproject.com/en/1.4/internals/deprecation/#id3
What does moving from the default django `sha_constructor` to the `hashlib.sha1` method actually change as far as behavior?

Perhaps we could use the `default_token_generator` used in `django.contrib.auth` for generating one-time tokens instead of this SHA1 method (source: https://github.com/django/django/blob/master/django/contrib/auth/tokens.py).  The benefits are that we're using the django core HMAC algorithm to construct our resultant token and crypto-safe, constant-time comparison utilities out of django core in order to accommodate things such as token expiration date.

This seems substantially better than using SHA1 in the manner we are today.  One (admittedly really unlikely) possible attack with the current scheme is that someone could perform a phishing attack on users to trick them into generating a password reset token, and then they could leverage SHA1's relatively low time complexity to brute force through the salt space (assuming they know the username, which is more likely given that it's feasibly the user's email address).  Again, this is an unlikely circumstance given our current userbase, etc., but moving to a safer hash mechanism could help minimize this attack plane, and seems slightly better than just substituting out one SHA1 implementation for another one which is probably leveraging the same `hashlib` call in the end anyway.