Thanks Aymeric Augustin for review.

Thanks Loic Bistuer for review.

Thanks hellbeast for the initial patch.

Changed the url template tag to use request.resolver_match.namespace as a
default for the current_app argument if request.current_app is not set.

Thanks Josh Smeaton for help on the tests.

Thanks claudep for the patch.

Thanks Baptiste Mispelon for report and review.

Thanks tkrapp for the report and Tim Graham for the review.

Also fixed missing django/contrib/auth/common-passwords.txt.gz file
and added JavaScript tests.

Thanks Gwildor Sok for the report and Tim Graham for the review.

contrib.auth.mixins is based on our work with django-braces.

Following discussion on django-developers:
https://groups.google.com/d/topic/django-developers/IkRgMxTTzPQ/discussion

Due to the URL encoding applied by the tag for all parameters that might be
partly controllable by an end-user, there are no XSS/security problems
caused by this bug, only invalid HTML.