To-do

remove ForceCanonicalHostnameMiddleware by ensuring canonical redirect and HTTPS redirect is done by Apache
serve a 400 in Apache for a hostname we don't explicitly support
use <detail> elements for supporter page hidden sections, rather than complex jQuery - or consider Alpine.js
replace internalNavigate with inline flexbox layout
migrate to Django 4.2
add deployment script that runs migrations and collects static files
add tests for main pages returning 200
switch to path in URLconfs
review apache2 directory - may be unused
standardise settings to replace settings.py and djangocommonsettings.py with settings/prod.py and move SECRET_KEY to an environment variable

Done

switch ParameterValidator to use SECRET_KEY if possible to minimize non-standard settings
install staticfiles app