We've encountered an issue related to two-factor authentication cookie validation after a major Django version upgrade, as detailed in issue [#686](https://github.com/jazzband/django-two-factor-auth/issues/686). This issue arises due to the change in user password hashes when Django's hash iteration count is updated in a new version, leading to a mismatch in the two-factor authentication cookies' validation.

We can for now implement a workaround. This involves catching the `BadSignature` exception raised during the cookie validation process when there's a mismatch in the hashes. This situation occurs after upgrading Django, which causes the user's password hash to change, thereby invalidating the existing two-factor authentication cookies.

This issue is critical for us to upgrade our Django version without disrupting the user experience of people coming back and having a 2FA cookie.

posthog/api/authentication.py
if request.user.is_authenticated:
        request.user.temporary_token = None
        request.user.save()
    if is_impersonated_session(request):
        restore_original_login(request)
        return redirect("/admin/")
    response = auth_views.logout_then_login(request)
    return response
def axes_locked_out(*args, **kwargs):
    return JsonResponse(
        {
            "type": "authentication_error",
            "code": "too_many_failed_attempts",
            "detail": "Too many failed login attempts. Please try again in"
            f" {int(settings.AXES_COOLOFF_TIME.seconds / 60)} minutes.",
            "attr": None,
        },
        status=status.HTTP_403_FORBIDDEN,
    )
def sso_login(request: HttpRequest, backend: str) -> HttpResponse:
    request.session.flush()
    sso_providers = get_instance_available_sso_providers()
    
    sso_providers["saml"] = settings.EE_AVAILABLE
    if backend not in sso_providers:
        return redirect(f"/login?error_code=invalid_sso_provider")
    if not sso_providers[backend]:
        return redirect(f"/login?error_code=improperly_configured_sso")
    return auth(request, backend)
class TwoFactorRequired(APIException):