## Is your feature request related to a problem?

It's possible to brute-force passwords if you're particularly determined

## Describe the solution you'd like

Install `django-axes`: https://django-axes.readthedocs.io/en/latest/2_installation.html


## Describe alternatives you've considered



## Additional context



#### *Thank you* for your feature request – we love each and every one!

posthog/api/test/test_action.py
response = self.client.post(
            "/api/action/",
            data={"name": "user signed up",},
            content_type="application/json",
            HTTP_ORIGIN="https://evilwebsite.com",
        )
        self.assertEqual(response.status_code, 403)
        self.user.temporary_token = "token123"
        self.user.save()
        response = self.client.post(
            "/api/action/?temporary_token=token123",
            data={"name": "user signed up",},
            content_type="application/json",
            HTTP_ORIGIN="https://somewebsite.com",
        )
        self.assertEqual(response.status_code, 200)
        response = self.client.post(
            "/api/action/?temporary_token=token123",
            data={"name": "user signed up and post to slack", "post_to_slack": True,},
            content_type="application/json",
            HTTP_ORIGIN="https://somewebsite.com",