redirect http[s]://govtrack.us to https://www.govtrack.us (was previously http:=>http:), give a 404 to any https: connection on an unrecognized domain (otherwise it would pass to Django but generate an error because it's a not-allowed host), and put the testing site behind https: