[FIX] website_mail : force login to post comment

Transform POST param into GET param when redirecting to login page can cause security issues. Now, instead of displaying textarea (even if public user) and the redirect to login page keeping written comment, we display the login button with a redirection to the page to comment.
The redirection happen before commenting, avoiding to remenber param such comment text, rating, ...

To post a comment, the user must:
- be connected
- have a token
- or have a sha_sign

addons/website_mail/views/website_mail.xml

@@ -40,8 +40,10 @@
                 :chatter_mode string: 'json' or 'post' depending on what kind of request you want
         -->
         <section id="discussion" class="hidden-print oe_website_portal o_website_mail_thread">
-            <section class="mb32 css_editable_mode_hidden hidden-print">
-                <form class="o_website_chatter_form" t-attf-action="/website_mail/post/#{chatter_mode}" method="POST" t-if="website.env.user != request.env['ir.model.data'].xmlid_to_object('base.public_user') or token or sha_in">
+            <t t-set="is_user_public" t-value="website.env.user == request.website.user_id"/>
+            <t t-set="can_comment" t-value="sha_in or token or not is_user_public"/>
+            <section class="mb32 hidden-print" t-if="can_comment">
+                <form class="o_website_chatter_form" t-attf-action="/website_mail/post/#{chatter_mode}" method="POST">
                     <img class="img pull-left img-circle" t-attf-src="/web/image/res.partner/#{user_id.partner_id.id}/image_small/50x50" style="width: 50px; margin-right: 10px;"/>
                     <div class="pull-left mb32" style="width: 75%%">
                         <textarea rows="4" name="message" class="form-control" placeholder="Write a message..."></textarea>
@@ -58,6 +60,10 @@
                     </div>
                 </form>
             </section>
+            <section class="mb32 hidden-print" t-if="not can_comment">
+                <h3>Leave a comment</h3>
+                <p>You must be <a t-attf-href="/web/login?redirect=#{quote_plus(request.httprequest.url + '#discussion')}">logged in</a> to post a comment.</p>
+            </section>
             <div class="clearfix"/>
             <ul class="media-list o_website_comments">
                 <t t-foreach="object.message_ids" t-as="message">