title: Django doesn't check passwords when reset
body: <p><br>
  I'm using Django's password_reset forms with overriden html files, and when I pushed my code to my server, I could suddenly make the password 1 character long, where they should at least be 8 characters long. BUT it does show an alert if password1 and password2 aren't identical<br></p>
  
  <p><strong>On my local machine the Django project was created using 1.11.3, and on the server the Django project was created in version 1.8.7.</strong><br><br><br>The form I use for posting the new password:</p>
  
  <pre><code>    &lt;form method="POST"&gt; {% csrf_token %}
         &lt;input name="new_password1" class="form-control" type="password" placeholder="Adgangskode"&gt;                                                 
  
         {% for key, value in form.errors.items %}
              &lt;strong&gt;{{ value|escape }}&lt;/strong&gt;                    
         {% endfor %}
  
         &lt;input name="new_password2" class="form-control" type="password" placeholder="Bekræft adgangskode"&gt;
         &lt;input type="submit" class="btn btn-default btn-block" value="Bekræft"&gt;
      &lt;/form&gt;
  </code></pre>
  
  <p><em>The question is: why does Django not properly validate the password (checking if it's are entirely numeric, or if it's longer than 8 characters), on the server, but perfectly on my local machine?</em></p>
  
  <p>Thanks</p>