Starting from Django 1.9.11, ALLOWED_HOSTS is also taken into account when DEBUG is turned on. See https://docs.djangoproject.com/en/1.10/releases/1.9.11/#dns-rebinding-vulnerability-when-debug-true
@@ -22,7 +22,7 @@ SECRET_KEY = 'ei3#@ejlp((&tlx2jrscs^wrvpn$y4o-7_(-$a_uc9%j3eux1*'
# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = True
-ALLOWED_HOSTS = []
+ALLOWED_HOSTS = ['localhost', '127.0.0.1', '::1']
# Application definition