We've encountered an issue related to two-factor authentication cookie validation after a major Django version upgrade, as detailed in issue [#686](https://github.com/jazzband/django-two-factor-auth/issues/686). This issue arises due to the change in user password hashes when Django's hash iteration count is updated in a new version, leading to a mismatch in the two-factor authentication cookies' validation.

We can for now implement a workaround. This involves catching the `BadSignature` exception raised during the cookie validation process when there's a mismatch in the hashes. This situation occurs after upgrading Django, which causes the user's password hash to change, thereby invalidating the existing two-factor authentication cookies.

This issue is critical for us to upgrade our Django version without disrupting the user experience of people coming back and having a 2FA cookie.

posthog/api/authentication.py
{"token": ["This reset token is invalid or has expired."]},
                code="invalid_token",
            )
        password = validated_data["password"]
        try:
            validate_password(password, user)
        except ValidationError as e:
            raise serializers.ValidationError({"password": e.messages})
        user.set_password(password)
        user.requested_password_reset_at = None
        user.save()
        login(
            self.context["request"],
            user,
            backend="django.contrib.auth.backends.ModelBackend",
        )
        report_user_password_reset(user)
        return True
class PasswordResetViewSet(NonCreatingViewSetMixin, viewsets.GenericViewSet):
    queryset = User.objects.none()
    serializer_class = PasswordResetSerializer
    permission_classes = (permissions.AllowAny,)
    throttle_classes = [UserPasswordResetThrottle]
    SUCCESS_STATUS_CODE = status.HTTP_204_NO_CONTENT
class PasswordResetCompleteViewSet(NonCreatingViewSetMixin, mixins.RetrieveModelMixin, viewsets.GenericViewSet):
    queryset = User.objects.none()
    serializer_class = PasswordResetCompleteSerializer
    permission_classes = (permissions.AllowAny,)
    SUCCESS_STATUS_CODE = status.HTTP_204_NO_CONTENT
    def get_object(self):