Reverts to changeset 435, and just add {% csrf_token %} to template forgot_pw.html, since CSRF protection seems to be only here (surely because of django.contrib.auth.views).
.tipsy { padding: 5px; font-size: 10px; opacity: 0.8; filter: alpha(opacity=80); background-repeat: no-repeat; }
.tipsy-inner { padding: 4px 5px; background-color: black; color: white; max-width: 200px; text-align: center; }
.tipsy-north { background-image: url(tipsy-north.gif); background-position: top center; }
.tipsy-south { background-image: url(tipsy-south.gif); background-position: bottom center; }
.tipsy-east { background-image: url(tipsy-east.gif); background-position: right center; }
.tipsy-west { background-image: url(tipsy-west.gif); background-position: left center; }