Add the now required ALLOWED_HOSTS setting
Make CSRF and Session cookies http_only now that the option is available
Add Postgres deps to the conf/packages file
Remove the sites framework, it's no longer enabled by default in Django 1.6
Enable click-jacking prevention by default, to match Django 1.6
Remove python-psycopg2 and add note about libpq-dev dependency.

python-psycopg2 is superseded by us having psycopg2 in requirements.txt anyway, but that package requires the postgres dev headers supplied by libpq-dev, so that it can be compiled when we pip install it.