More permissive CSRF check for Django when moving between HTTP and HTTPS