Django Security Fixes

Django stacks commonly need django-cors-headers for SPAs and hardened SECURE_* settings behind TLS proxies. HeadersFixer helps verify what users see after X-Forwarded-Proto rewriting.

Review CORS errors when CSRF and CORS interact on cookie sessions.