Bug 1019605

Description of problem:

When using SSL,
it may be useful to add python-django-secure to INSTALLED_APPS in /usr/share/openstack-dashboard/openstack_dashboard/settings.py

Also, when on SSL:
- Set the SECURE_SSL_REDIRECT setting to True if all non-SSL requests should be permanently redirected to SSL.
- Set the SECURE_HSTS_SECONDS setting to an integer number of seconds and SECURE_HSTS_INCLUDE_SUBDOMAINS to True, if you want to use HTTP Strict Transport Security.
- Set the SECURE_FRAME_DENY setting to True, if you want to prevent framing of your pages and protect them from clickjacking.
- Set the SECURE_CONTENT_TYPE_NOSNIFF setting to True, if you want to prevent the browser from guessing asset content types.
- Set the SECURE_BROWSER_XSS_FILTER setting to True, if you want to enable the browser’s XSS filtering protections.
- Set SESSION_COOKIE_SECURE and SESSION_COOKIE_HTTPONLY to True if you are using django.contrib.sessions. These settings are not part of django-secure, but they should be used if running a secure site, and the checksecure management command will check their values.

Those settings can be checked with django-secure installed and running ./mangage.py checksecure

I forgot: many (all?) of these options are only applicable, when also using SSL, because redirects will be directed to the ssl site.