Get the SECRET_KEY from heroku env vars
Set debug to false in production
Log to stdout in production
Limit the allowed hosts
Make dj-static also serve user uploaded media files