CHANGES: note cdn urls update
use django's clickjacking protection middleware