WIP: Integrating django-secure

For background info, please see the [django-developers thread](https://groups.google.com/d/topic/django-developers/t8ybImtdnpM/discussion).
Per the discussions on the mailing list, it may be worth an explicit note here that this is a setting you can't "take back" once you set it in production, so you definitely want to start with a low value and test. Suggested wording (append to existing):

```
Be sure you understand how HSTS works before enabling it! Anyone who visits your site while HSTS is enabled will then only be able to access it via HTTPS for the remainder of the timeout you specify, even if you later disable HSTS. So when enabling this in production, you should start with a low value (less than one day) and test thoroughly before increasing the timeout length.
```