WIP: Integrating django-secure

For background info, please see the [django-developers thread](https://groups.google.com/d/topic/django-developers/t8ybImtdnpM/discussion).
The only reason `SECURE_HSTS_INCLUDE_SUBDOMAINS` defaults to `False` is for backwards-compatibility for django-secure users. Porting to Django might be an opportunity to change this default, since people moving from django-secure to Django 1.8 will already need to be aware of some changes (the frame options setting, for instance). As I understand it (@dstufft can confirm), if you are using HSTS at all, it's only in rare cases that you would not want to include subdomains.

On the other hand, it could be really bad if a `django-secure` user who intentionally relied on this being `False` migrated to Django 1.8 and didn't realize the default had changed, and it got accidentally flipped to `True`. So I guess we'd better not change the default. Having a warning telling people to switch it to `True` will have to be good enough.