diff --git a/pflaenzli/pflaenzli/views.py b/pflaenzli/pflaenzli/views.py
index 772bad2..8fb8bc9 100644
--- a/pflaenzli/pflaenzli/views.py
+++ b/pflaenzli/pflaenzli/views.py
@@ -203,7 +203,7 @@ def get_single_plz(plz):
 
 
 def save_language(request):
-    referer_url = request.META.get('HTTP_REFERER')
+    referer_url = request.headers.get('referer')
     response = redirect(referer_url)
 
     if request.method == 'POST':
diff --git a/pflaenzli/pflaenzli_django/settings.py b/pflaenzli/pflaenzli_django/settings.py
index ea9fc1e..afb89b4 100644
--- a/pflaenzli/pflaenzli_django/settings.py
+++ b/pflaenzli/pflaenzli_django/settings.py
@@ -30,10 +30,10 @@ BASE_DIR = Path(__file__).resolve().parent.parent
 SECRET_KEY = "django-insecure-q=ps#iypevr!3zfpwtfp3lw#4r3%oyj*(2=*iq^8f4_zbodi^("
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = os.getenv('DJANGO_DEBUG') == 'true'
+DEBUG = True
 
-ALLOWED_HOSTS = os.getenv('DJANGO_ALLOWED_HOSTS', '').split(',')
-CSRF_TRUSTED_ORIGINS = os.getenv('DJANGO_CSRF_TRUSTED_ORIGINS', '').split(',')
+ALLOWED_HOSTS = os.getenv('DJANGO_ALLOWED_HOSTS', 'localhost').split(',')
+CSRF_TRUSTED_ORIGINS = os.getenv('DJANGO_CSRF_TRUSTED_ORIGINS', 'http://localhost:8080').split(',')
 
 # Application definition