Anonymous users were able to access pages that used
the 'public' decorator of stronghold. If such a page
showed the installation routine of the setup module
they were able to access and use it, in other words:
Anonymous users were able to install software.
Don't raise a 404 exception when a page is not found. Instead, simply
bypass the setup middleware so that other middleware have a chance to
process further.
Slight modification so that resolve method can be mocked during
unittests.
Django runs process_request() on all the middleware classes in order.
Then it runs process_view() on all of them again. During the runs, if
any of the views return a HttpResponse. Further processing is ignored.
Setup middleware was handling process_request() and returning
HttpResponse if the application as not setup. However, stronghold
middleware handles process_view(). Since process_request happens first
and response is being returned there, stronghold middleware is never
called.
Make setup middleware use process_view() instead.
