It should be better to put `django<1.7` here, so security fixes are not ignored.