return1/django-sslify-admin — pull request #2 by Bouke (2013-06-19 11:02:09+00:00)
Title: Do not inspect HTTP_X_FORWARDED_PROTO

Attacker could inject such headers, circumventing the SSL redirect. See #1.