One thing that Django would definitely benefit from is support for  
simple protection against CSRF attacks. The admin site should have  
this turned on by default, and some kind of mechanism for easily  
applying it to custom code would be welcome as well.

CSRF attacks are described in detail here:

http://www.squarefree.com/securitytips/web-developers.html#CSRF

(Further info at the bottom of the page)

Basically, if I can trick you in to visiting a page that I control  
while you are logged in to Django's admin, and I can guess the URL of  
things within that admin, I can add/edit/delete the content on your  
site by hiding my own form targeting your admin site on my page and  
using JavaScript to get your browser to submit it.

The only guaranteed defence against this attack is to include in  
every form a hidden field containing a one-time secret that an  
attacker couldn't possibly guess. The secret "proves" that the form  
being submitted was originally served by your site, not created by an  
imposter.

I've filed a bug to track developments on this: http://
code.djangoproject.com/ticket/510

Cheers,

Simon Willison