Completely re-reading the security book

| Q             | A
| ------------- | ---
| Doc fix?      | no
| New docs?     | no
| Applies to    | all
| Fixed tickets | n/a

Well, this should be interesting :). Several years ago, I bootstrapped the security chapter and it's been there ever since. That fact doesn't necessarily mean that it was good. I've just re-read and basically re-written the chapter from scratch. I thought it was too long, too theoretical in the beginning, and it also had some extra "baggage" just from being old and having things added to it.

My goal is to:

A) Not actually remove anything of importance - I've done my best with this
B) Actually get feedback that this is better. I feel that this is better, but rewrites aren't automatically better. It's like the second album of a band - even though they're older and wiser, maybe the original is still better :). I hope not!

Todo:

- [ ] fill in config blocks - @xabbuh if you happen to have some time and can help, I would be even more in debt to you :)

As I merge to 2.5 and up, I'll need to check for the `versionadded` tags on each branch and re-add those things to the new chapter.

Thanks!
Is the only difference between `form_login` and `simple_form` the fact that `simple_form` *requires* the `authenticator` key?

If that's true, the we could potentially have an addendum/note to this chapter that says something like:

>
If you have a form login, but need to do something custom to check the username and password validity (e.g. call out to an API or have a third field - e.g. ``accessKey`` in your login form) then you can use the very similar `simple_form` with a custom authentication [link].