Use request.get_host() and added ALLOWED_HOSTS setting.

Host header poisoning issues were fixed in Django 1.3.6 and 1.4.4, and it added
the new ALLOWED_HOSTS setting, which prevents attackers from poisoning hosts. In
order to make use of this security measure, request.get_host() should be used
instead of request.META['HTTP_HOST'] where applicable.