WIP: Integrating django-secure

For background info, please see the [django-developers thread](https://groups.google.com/d/topic/django-developers/t8ybImtdnpM/discussion).
It's a bit odd that we set the default to `SAMEORIGIN` and then have an enabled-by-default deployment check telling people they really should set it to `DENY` instead. But I guess this at least accomplishes the goal of getting them to think about what value they need :-)