Better CI security
Pin down Django version
Deploy only once