Ensure CSRF_TRUSTED_ORIGINS and ALLOWED_HOSTS are specified

[jacobdgm]

This PR specifies a CSRF_TRUSTED_ORIGINS and ALLOWED_HOSTS in settings.py, and thus fixes #1288.

[dchiller]

I think all of these should depend on the deployment environment. So staging.cantusdatabase.org should not be allowed on production, etc.

[jacobdgm]

ah, and I see on line 42 that we use os.getenv to set ALLOWED_HOSTS. If we merged this change, it would overwrite that. Let me see what I can do to properly address this.

[jacobdgm]

I made some changes. Please also refer to the "CantusDB Resources" page on the internal wiki to see the accompanying changes to the dev_env file.