Reverted "Fixed #28248 -- Fixed password reset tokens being valid for 1 day longer than PASSWORD_RESET_TIMEOUT_DAYS."

This reverts commit 95993a89.

Regression introduced in 1f3dfd78.

Forward port of 60010417 from stable/2.0.x.

Per deprecation timeline.

Per deprecation timeline.

Refs #25187 -- Required the authenticate() method of authentication backends to have request as the first positional argument.

Per deprecation timeline.

Per deprecation timeline.

Per deprecation timeline.

Refs #20892 -- Removed support for passing pylibmc behavior settings as top-level attributes of CACHES['OPTIONS'].

Per deprecation timeline.

Per deprecation timeline.

Per deprecation timeline.

Thanks Anssi Kääriäinen for contributing to the patch.

Unused since its introduction in d725cc97.

_populate() sets the populating attribute to prevent infinite recursion in
case a urlconf includes itself. The flag is a threadlocal to avoid a race
condition [1] where one thread sets the flag and another checks it, then
proceeds to access data that's supposed to be populated (e.g. _reverse_dict)
but isn't yet.

The potential still exists for a thread to set the threadlocal, then be
interrupted by a signal such as SIGALRM and raise before resetting the
threadlocal flag. In this scenario, subsequent calls to _populate() in the
same thread will short-circuit erroneously.

The bulk of the method was already wrapped in a try/finally in df41b5a0, but
since a signal interrupt can occur at any line executed by the interpreter,
this moves up the try to ensure threadlocal gets reset.

[1]: https://groups.google.com/d/msg/django-developers/D_bIeinKHjE/4NmVQUJqAgAJ

Thanks Adam Johnson, Carl Meyer, Anssi Kääriäinen, Mariusz Felisiak,
Michael Manfre, and Tim Graham for discussion and review.

Thanks Aymeric Augustin for shepherding the DEP and patch review.
Thanks Marten Kenbeek and Tim Graham for contributing to the code.
Thanks Tom Christie, Shai Berger, and Tim Graham for the docs.

Regression in eef95ea9.