title: Django Admin CSRF Verification Failed when debug=False
body: <p>I'm building a Django (1.9.6) app, hosted on Heroku with gunicorn with a Let's Encrypt SSL certificate. When I try to save a model in admin I'm greeted with a Forbidden 403 error, with the message "CSRF verification failed. Request aborted. More information is available with DEBUG=True." If I set debug to True I no longer get the error.</p>
  
  <p>My settings.py file has:</p>
  
  <pre><code>ALLOWED_HOSTS = ['localhost', '.example.com']
  
  MIDDLEWARE_CLASSES = [
      'django.middleware.security.SecurityMiddleware',
      'whitenoise.middleware.WhiteNoiseMiddleware',
      'django.contrib.sessions.middleware.SessionMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.middleware.csrf.CsrfViewMiddleware',
      'django.contrib.auth.middleware.AuthenticationMiddleware',
      'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
      'django.contrib.messages.middleware.MessageMiddleware',
      'django.middleware.clickjacking.XFrameOptionsMiddleware',
  ]
  
  SECURE_SSL_REDIRECT = True
  SESSION_COOKIE_SECURE = True
  SESSION_EXPIRE_AT_BROWSER_CLOSE = True
  CSRF_COOKIE_SECURE = True
  CSRF_TRUSTED_ORIGINS = ['localhost', '.example.com']
  SECURE_HSTS_SECONDS = 60
  SECURE_HSTS_INCLUDE_SUBDOMAINS = True
  </code></pre>
  
  <p>I've tried playing around with different settings including CSRF_COOKIE_DOMAIN and I've cleared my cache and cookies.</p>
  
  <p>I recently migrated my database from SQLite to PostgreSQL so I thought it might be related to pk counters getting reset to 1; I tried deleting my models in the database to fix this but I still can't save models.</p>
  
  <p>I'm also noticing that one of my Django {% include template.html %} tags isn't working, not sure if that's related.</p>