Update commonware, etc

* Update commonware to v0.4.2 
* Some middlewares were moved to django-statsd so I added that to vendor
* Added the missing X-* middlewares for extra protection
* Migrated to django's built-in xframe protection

r?