Good password hashing is important. However, every single Django application being vulnerable to CSRF is a much bigger deal. ;-)