settings.py.sample:add secure_cookie, set xsrf_cookies