debian is sloooow, so I have to help myself (https://www.djangoproject.com/weblog/2013/sep/15/security/)