## Is your feature request related to a problem?

It's possible to brute-force passwords if you're particularly determined

## Describe the solution you'd like

Install `django-axes`: https://django-axes.readthedocs.io/en/latest/2_installation.html


## Describe alternatives you've considered



## Additional context



#### *Thank you* for your feature request – we love each and every one!

posthog/api/test/test_decide.py
user = self.organization.members.first()
        user.toolbar_mode = "disabled"
        user.save()
        self.team.app_urls = ["https://example.com/maybesubdomain"]
        self.team.save()
        
        response = self.client.get("/decide", HTTP_ORIGIN="https://example.com").json()
        self.assertEqual(response["isAuthenticated"], True)
        self.assertIsNone(response.get("toolbarVersion", None))
    def test_user_on_evil_site(self):
        user = self.organization.members.first()
        user.toolbar_mode = "toolbar"
        user.save()
        self.team.app_urls = ["https://example.com"]
        self.team.save()
        response = self.client.get("/decide/", HTTP_ORIGIN="https://evilsite.com").json()
        self.assertEqual(response["isAuthenticated"], False)
        self.assertIsNone(response["editorParams"].get("toolbarVersion", None))
    def test_user_on_local_host(self):
        user = self.organization.members.first()
        user.toolbar_mode = "toolbar"
        user.save()
        self.team.app_urls = ["https://example.com"]
        self.team.save()
        response = self.client.get("/decide", HTTP_ORIGIN="http://127.0.0.1:8000").json()
        self.assertEqual(response["isAuthenticated"], True)
        self.assertEqual(response["sessionRecording"], False)
        self.assertEqual(response["editorParams"]["toolbarVersion"], "toolbar")
    def test_user_session_recording_opt_in(self):