Rename django-cors-headers settings
Version 3.5.0 (!975 (merged)) renames the settings to avoid the term "whitelist"; see the changelog. The old settings continue to work as aliases, but we should rename them to make future upgrades easier if the aliases get removed someday.