From documentation: https://docs.djangoproject.com/en/1.10/ref/settings/
if DEBUG is False, you also need to properly set the ALLOWED_HOSTS setting. Failing to do so will result in all requests being returned as “Bad Request (400)”.
And from here: https://docs.djangoproject.com/en/1.10/ref/settings/#std:setting-ALLOWED_HOSTS
I am using something like this:
ALLOWED_HOSTS = ['localhost', '127.0.0.1', 'www.mysite.com']