login_required decorator that doesn't redirect
A login_required decorator that wraps the login view instead of redirecting to it. This prevents your site from leaking login information with HTTP status codes as explained [here](https://grepular.com/Abusing_HTTP_Status_Codes_to_Expose_Private_Information). This is the way Django's admin is protected, the difference being that it checks for is_active and is_staff instead of is_authenticated. With this decorators, users directly see a login form (no redirect), post it to LOGIN_URL and are redirected to the page they first tried to see.
- redirect
- login_required