allowed_hosts
don't server static and media through https, longer image field, some other fixes