Go go gadget django-secure!

This should give some kind of meaning to our SECURE_* settings, and finally end
the HTTPS saga.