Use reverse_lazy in settings.py

Hi!

  It's my first pull request, pardon my noob-ness :)

  I changed `settings.py` to use `reverse_lazy()` when calculating the `PASSIVE_URLS` list, since it seems that `settings.py` gets loaded before the final URLs are generated.

  You can recreate my issue using apache.  Serve your app from a virtual host with 
 `WSGIScriptAlias /prefix /path/to/wsgi.py`

  If you log the `request.path` in the middleware, you'll see
`/prefix/session_security/ping/`
  However the `PASSIVE_URLS` list will have
`/session_security/ping`

  Using `reverse_lazy` seems to fix the issue.

  Otherwise this works like a charm.  Thanks for a great solution to a problem!

Cheers,
-Matt