Signed-off-by: hitech95 <nicveronese@gmail.com>
(cherry picked from commit fc8926493c2adc03f2a4104f2b46a3b6a7043782)

Add spaces

(cherry picked from commit 630a4e9b5e18d301c83f8e49de366656c44d0857)

#2283

(cherry picked from commit 8775dc5b155d7ad97672f1eb5b47a9dd01031211)

(cherry picked from commit 7bd1fd34)

Make the caller responsible to know whether the rate-limit code should
be called or not

(cherry picked from commit 7f89a297)

Ensure that webmail tokens are in sync with sessions

This is also fixing tokens on /webdav/

Rate limiting was already redesigned to use Python limits. This
introduced some unexpected behavior, including the fact that only
one criteria is supported per limiter. Docs and setup utility are
updated with this in mind.

Also, the code was made more generic, so limiters can be delivered
for something else than authentication. Authentication-specific
code was moved directly to the authentication routine.

The init script was pushing an application context, which maked
flask.g global and persisted across requests. This was evaluated
to have a minimal security impact.

This explains/fixes #738: flask_wtf caches the csrf token in the
application context to have a single token per request, and only
sets the session attribute after the first generation.