## Is your feature request related to a problem?

It's possible to brute-force passwords if you're particularly determined

## Describe the solution you'd like

Install `django-axes`: https://django-axes.readthedocs.io/en/latest/2_installation.html


## Describe alternatives you've considered



## Additional context



#### *Thank you* for your feature request – we love each and every one!

posthog/api/test/test_decide.py
import base64
import json
from unittest.mock import patch
from posthog.models import FeatureFlag, Person, PersonalAPIKey
from .base import BaseTest
class TestDecide(BaseTest):
    TESTS_API = True
    def _dict_to_b64(self, data: dict) -> str:
        return base64.b64encode(json.dumps(data).encode("utf-8")).decode("utf-8")
    def _post_decide(self, data=None, origin="http://127.0.0.1:8000"):
        return self.client.post(
            "/decide/",
            {"data": self._dict_to_b64(data or {"token": self.team.api_token, "distinct_id": "example_id"})},
            HTTP_ORIGIN=origin,
        ).json()
    def test_user_on_own_site_enabled(self):
        user = self.organization.members.first()
        user.toolbar_mode = "toolbar"
        user.save()
        self.team.app_urls = ["https://example.com/maybesubdomain"]
        self.team.save()
        response = self.client.get("/decide/", HTTP_ORIGIN="https://example.com").json()
        self.assertEqual(response["isAuthenticated"], True)
        self.assertEqual(response["editorParams"]["toolbarVersion"], "toolbar")
    def test_user_on_own_site_disabled(self):