rdegges/django-sslify — pull request #3 by return1 (2013-06-28 17:02:24+00:00)
Title: Do not inspect HTTP_X_FORWARDED_PROTO

quoted from the original ticket author at my `django-sslify-admin` repo:
_Currently, `HTTP_X_FORWARDED_PROTO` is always inspected. However; this header can be faked. As noted by the devs of django, you should be very explicit with such options: https://docs.djangoproject.com/en/dev/ref/settings/#secure-proxy-ssl-header. It think that the check should be removed and force users to set their `SECURE_PROXY_SSL_HEADER` correctly._

please check this https://github.com/return1/django-sslify-admin/issues/1 ticket for credits to the original bug hunter.