diff --git a/.travis.sh b/.travis.sh
index 11a090a55..15691b539 100755
--- a/.travis.sh
+++ b/.travis.sh
@@ -15,13 +15,13 @@ if [ "$PRETIX_CONFIG_FILE" == "tests/travis_postgres.cfg" ]; then
 fi
 
 if [ "$1" == "style" ]; then
-	XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements.txt -r src/requirements/dev.txt -r src/requirements/py34.txt
+	XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements.txt -r src/requirements/dev.txt
 	cd src
     flake8 .
     isort -c -rc -df .
 fi
 if [ "$1" == "doctests" ]; then
-	XDG_CACHE_HOME=/cache pip3 install -Ur doc/requirements.txt -r src/requirements/py34.txt
+	XDG_CACHE_HOME=/cache pip3 install -Ur doc/requirements.txt
 	cd doc
 	make doctest
 fi
@@ -39,21 +39,21 @@ if [ "$1" == "translation-spelling" ]; then
 	potypo
 fi
 if [ "$1" == "tests" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt -r src/requirements/py34.txt pytest-xdist
+	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt pytest-xdist
 	cd src
 	python manage.py check
 	make all compress
 	py.test --reruns 5 -n 2 tests
 fi
 if [ "$1" == "tests-cov" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt -r src/requirements/py34.txt
+	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt
 	cd src
 	python manage.py check
 	make all compress
 	coverage run -m py.test --reruns 5 tests && codecov
 fi
 if [ "$1" == "plugins" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt -r src/requirements/py34.txt
+	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt
 	cd src
 	python setup.py develop
 	make all compress
diff --git a/.travis.yml b/.travis.yml
index f68b87204..e12f21945 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -18,20 +18,10 @@ matrix:
       env: JOB=tests-cov PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
     - python: 3.6
       env: JOB=style
-    - python: 3.4
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg
     - python: 3.5
       env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg
-    - python: 3.4
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_mysql.cfg
-    - python: 3.5
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_mysql.cfg
     - python: 3.6
       env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_mysql.cfg
-    - python: 3.4
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
-    - python: 3.5
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
     - python: 3.6
       env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
     - python: 3.6
diff --git a/doc/admin/installation/manual_smallscale.rst b/doc/admin/installation/manual_smallscale.rst
index d301ea999..816ba0fa0 100644
--- a/doc/admin/installation/manual_smallscale.rst
+++ b/doc/admin/installation/manual_smallscale.rst
@@ -121,8 +121,7 @@ command if you're running PostgreSQL::
 
     (venv)$ pip3 install "pretix[mysql]" gunicorn
 
-If you are running Python 3.4, you also need to ``pip3 install typing``. This is not required on 3.5 or newer.
-You can find out your Python version using ``python -V``.
+Note that you need Python 3.5 or newer. You can find out your Python version using ``python -V``.
 
 We also need to create a data directory::
 
diff --git a/doc/development/api/customview.rst b/doc/development/api/customview.rst
index 710b804b2..fbf1f6b90 100644
--- a/doc/development/api/customview.rst
+++ b/doc/development/api/customview.rst
@@ -64,7 +64,7 @@ Similarly, there is ``organizer_permission_required`` and ``OrganizerPermissionR
 event-related views, there is also a signal that allows you to add the view to the event navigation like this::
 
 
-    from django.core.urlresolvers import resolve, reverse
+    from django.urls import resolve, reverse
     from django.dispatch import receiver
     from django.utils.translation import ugettext_lazy as _
     from pretix.control.signals import nav_event
diff --git a/doc/development/setup.rst b/doc/development/setup.rst
index 51bc36760..028a10c1f 100644
--- a/doc/development/setup.rst
+++ b/doc/development/setup.rst
@@ -18,7 +18,7 @@ External Dependencies
 ---------------------
 Your should install the following on your system:
 
-* Python 3.4 or newer
+* Python 3.5 or newer
 * ``pip`` for Python 3 (Debian package: ``python3-pip``)
 * ``python-dev`` for Python 3 (Debian package: ``python3-dev``)
 * ``libffi`` (Debian package: ``libffi-dev``)
@@ -54,10 +54,6 @@ The first thing you need are all the main application's dependencies::
     cd src/
     pip3 install -r requirements.txt -r requirements/dev.txt
 
-If you are working with Python 3.4, you will also need (you can skip this for Python 3.5+)::
-
-    pip3 install -r requirements/py34.txt
-
 Next, you need to copy the SCSS files from the source folder to the STATIC_ROOT directory::
 
     python manage.py collectstatic --noinput
diff --git a/src/pretix/api/migrations/0001_initial.py b/src/pretix/api/migrations/0001_initial.py
index d56fb19ef..b768aebbf 100644
--- a/src/pretix/api/migrations/0001_initial.py
+++ b/src/pretix/api/migrations/0001_initial.py
@@ -46,7 +46,7 @@ class Migration(migrations.Migration):
                 ('updated', models.DateTimeField(auto_now=True)),
                 ('name', models.CharField(max_length=255, verbose_name='Application name')),
                 ('redirect_uris', models.TextField(help_text='Allowed URIs list, space separated',
-                                                   validators=[oauth2_provider.validators.validate_uris],
+                                                   validators=[oauth2_provider.validators.URIValidator],
                                                    verbose_name='Redirection URIs')),
                 ('client_id',
                  models.CharField(db_index=True, default=oauth2_provider.generators.generate_client_id, max_length=100,
diff --git a/src/pretix/api/models.py b/src/pretix/api/models.py
index 189d04efb..7a62d0e66 100644
--- a/src/pretix/api/models.py
+++ b/src/pretix/api/models.py
@@ -11,13 +11,13 @@ from oauth2_provider.models import (
     AbstractAccessToken, AbstractApplication, AbstractGrant,
     AbstractRefreshToken,
 )
-from oauth2_provider.validators import validate_uris
+from oauth2_provider.validators import URIValidator
 
 
 class OAuthApplication(AbstractApplication):
     name = models.CharField(verbose_name=_("Application name"), max_length=255, blank=False)
     redirect_uris = models.TextField(
-        blank=False, validators=[validate_uris],
+        blank=False, validators=[URIValidator],
         verbose_name=_("Redirection URIs"),
         help_text=_("Allowed URIs list, space separated")
     )
diff --git a/src/pretix/api/views/checkin.py b/src/pretix/api/views/checkin.py
index 964d56862..f5931b20a 100644
--- a/src/pretix/api/views/checkin.py
+++ b/src/pretix/api/views/checkin.py
@@ -32,7 +32,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
     serializer_class = CheckinListSerializer
     queryset = CheckinList.objects.none()
     filter_backends = (DjangoFilterBackend,)
-    filter_class = CheckinListFilter
+    filterset_class = CheckinListFilter
     permission = 'can_view_orders'
     write_permission = 'can_change_event_settings'
 
@@ -175,7 +175,7 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
         },
     }
 
-    filter_class = CheckinOrderPositionFilter
+    filterset_class = CheckinOrderPositionFilter
     permission = 'can_view_orders'
     write_permission = 'can_change_orders'
 
diff --git a/src/pretix/api/views/event.py b/src/pretix/api/views/event.py
index cb92fc110..d68512902 100644
--- a/src/pretix/api/views/event.py
+++ b/src/pretix/api/views/event.py
@@ -129,7 +129,7 @@ class SubEventViewSet(ConditionalListView, viewsets.ReadOnlyModelViewSet):
     serializer_class = SubEventSerializer
     queryset = ItemCategory.objects.none()
     filter_backends = (DjangoFilterBackend, filters.OrderingFilter)
-    filter_class = SubEventFilter
+    filterset_class = SubEventFilter
 
     def get_queryset(self):
         return self.request.event.subevents.prefetch_related(
diff --git a/src/pretix/api/views/item.py b/src/pretix/api/views/item.py
index 27585f724..b89d5c8e3 100644
--- a/src/pretix/api/views/item.py
+++ b/src/pretix/api/views/item.py
@@ -41,7 +41,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
-    filter_class = ItemFilter
+    filterset_class = ItemFilter
     permission = 'can_change_items'
     write_permission = 'can_change_items'
 
@@ -207,7 +207,7 @@ class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = ItemCategorySerializer
     queryset = ItemCategory.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter)
-    filter_class = ItemCategoryFilter
+    filterset_class = ItemCategoryFilter
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
     permission = 'can_change_items'
@@ -261,7 +261,7 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = QuestionSerializer
     queryset = Question.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter)
-    filter_class = QuestionFilter
+    filterset_class = QuestionFilter
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
     permission = 'can_change_items'
@@ -359,7 +359,7 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = QuotaSerializer
     queryset = Quota.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter,)
-    filter_class = QuotaFilter
+    filterset_class = QuotaFilter
     ordering_fields = ('id', 'size')
     ordering = ('id',)
     permission = 'can_change_items'
diff --git a/src/pretix/api/views/order.py b/src/pretix/api/views/order.py
index 90c40061f..7e3112543 100644
--- a/src/pretix/api/views/order.py
+++ b/src/pretix/api/views/order.py
@@ -45,10 +45,10 @@ from pretix.base.signals import order_placed, register_ticket_outputs
 
 
 class OrderFilter(FilterSet):
-    email = django_filters.CharFilter(name='email', lookup_expr='iexact')
-    code = django_filters.CharFilter(name='code', lookup_expr='iexact')
-    status = django_filters.CharFilter(name='status', lookup_expr='iexact')
-    modified_since = django_filters.IsoDateTimeFilter(name='last_modified', lookup_expr='gte')
+    email = django_filters.CharFilter(field_name='email', lookup_expr='iexact')
+    code = django_filters.CharFilter(field_name='code', lookup_expr='iexact')
+    status = django_filters.CharFilter(field_name='status', lookup_expr='iexact')
+    modified_since = django_filters.IsoDateTimeFilter(field_name='last_modified', lookup_expr='gte')
 
     class Meta:
         model = Order
@@ -61,7 +61,7 @@ class OrderViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('datetime',)
     ordering_fields = ('datetime', 'code', 'status')
-    filter_class = OrderFilter
+    filterset_class = OrderFilter
     lookup_field = 'code'
     permission = 'can_view_orders'
     write_permission = 'can_change_orders'
@@ -307,7 +307,7 @@ class OrderViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
 
 
 class OrderPositionFilter(FilterSet):
-    order = django_filters.CharFilter(name='order', lookup_expr='code__iexact')
+    order = django_filters.CharFilter(field_name='order', lookup_expr='code__iexact')
     has_checkin = django_filters.rest_framework.BooleanFilter(method='has_checkin_qs')
     attendee_name = django_filters.CharFilter(method='attendee_name_qs')
     search = django_filters.CharFilter(method='search_qs')
@@ -345,7 +345,7 @@ class OrderPositionViewSet(viewsets.ReadOnlyModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('order__datetime', 'positionid')
     ordering_fields = ('order__code', 'order__datetime', 'positionid', 'attendee_name', 'order__status',)
-    filter_class = OrderPositionFilter
+    filterset_class = OrderPositionFilter
     permission = 'can_view_orders'
 
     def get_queryset(self):
@@ -590,7 +590,7 @@ class RefundViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
 class InvoiceFilter(FilterSet):
     refers = django_filters.CharFilter(method='refers_qs')
     number = django_filters.CharFilter(method='nr_qs')
-    order = django_filters.CharFilter(name='order', lookup_expr='code__iexact')
+    order = django_filters.CharFilter(field_name='order', lookup_expr='code__iexact')
 
     def refers_qs(self, queryset, name, value):
         return queryset.annotate(
@@ -617,7 +617,7 @@ class InvoiceViewSet(viewsets.ReadOnlyModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('nr',)
     ordering_fields = ('nr', 'date')
-    filter_class = InvoiceFilter
+    filterset_class = InvoiceFilter
     permission = 'can_view_orders'
     lookup_url_kwarg = 'number'
     lookup_field = 'nr'
diff --git a/src/pretix/api/views/organizer.py b/src/pretix/api/views/organizer.py
index b2ab942a0..b23f03f7b 100644
--- a/src/pretix/api/views/organizer.py
+++ b/src/pretix/api/views/organizer.py
@@ -12,7 +12,7 @@ class OrganizerViewSet(viewsets.ReadOnlyModelViewSet):
     lookup_url_kwarg = 'organizer'
 
     def get_queryset(self):
-        if self.request.user.is_authenticated():
+        if self.request.user.is_authenticated:
             if self.request.user.has_active_staff_session(self.request.session.session_key):
                 return Organizer.objects.all()
             elif isinstance(self.request.auth, OAuthAccessToken):
diff --git a/src/pretix/api/views/voucher.py b/src/pretix/api/views/voucher.py
index 73e7f8cf1..e31157cc2 100644
--- a/src/pretix/api/views/voucher.py
+++ b/src/pretix/api/views/voucher.py
@@ -34,7 +34,7 @@ class VoucherViewSet(viewsets.ModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('id',)
     ordering_fields = ('id', 'code', 'max_usages', 'valid_until', 'value')
-    filter_class = VoucherFilter
+    filterset_class = VoucherFilter
     permission = 'can_view_vouchers'
     write_permission = 'can_change_vouchers'
 
diff --git a/src/pretix/api/views/waitinglist.py b/src/pretix/api/views/waitinglist.py
index 36f6e8bf7..cf649dc43 100644
--- a/src/pretix/api/views/waitinglist.py
+++ b/src/pretix/api/views/waitinglist.py
@@ -28,7 +28,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('created',)
     ordering_fields = ('id', 'created', 'email', 'item')
-    filter_class = WaitingListFilter
+    filterset_class = WaitingListFilter
     permission = 'can_view_orders'
     write_permission = 'can_change_orders'
 
diff --git a/src/pretix/base/forms/auth.py b/src/pretix/base/forms/auth.py
index 8162d3173..f4f92d4ce 100644
--- a/src/pretix/base/forms/auth.py
+++ b/src/pretix/base/forms/auth.py
@@ -39,7 +39,7 @@ class LoginForm(forms.Form):
         password = self.cleaned_data.get('password')
 
         if email and password:
-            self.user_cache = authenticate(email=email.lower(), password=password)
+            self.user_cache = authenticate(request=self.request, email=email.lower(), password=password)
             if self.user_cache is None:
                 raise forms.ValidationError(
                     self.error_messages['invalid_login'],
diff --git a/src/pretix/base/middleware.py b/src/pretix/base/middleware.py
index ab0324c4d..a2f1fedf2 100644
--- a/src/pretix/base/middleware.py
+++ b/src/pretix/base/middleware.py
@@ -3,8 +3,8 @@ from urllib.parse import urlsplit
 
 import pytz
 from django.conf import settings
-from django.core.urlresolvers import get_script_prefix
 from django.http import HttpRequest, HttpResponse
+from django.urls import get_script_prefix
 from django.utils import timezone, translation
 from django.utils.cache import patch_vary_headers
 from django.utils.deprecation import MiddlewareMixin
diff --git a/src/pretix/base/migrations/0098_auto_20180731_1243.py b/src/pretix/base/migrations/0098_auto_20180731_1243.py
new file mode 100644
index 000000000..bf04b2306
--- /dev/null
+++ b/src/pretix/base/migrations/0098_auto_20180731_1243.py
@@ -0,0 +1,56 @@
+# Generated by Django 2.0.7 on 2018-07-31 12:43
+
+import django.core.validators
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+import pretix.base.validators
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0097_auto_20180722_0804'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='logentry',
+            options={'ordering': ('-datetime', '-id')},
+        ),
+        migrations.AlterField(
+            model_name='orderpayment',
+            name='fee',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='payments', to='pretixbase.OrderFee'),
+        ),
+        migrations.AlterField(
+            model_name='organizer',
+            name='slug',
+            field=models.SlugField(help_text='Should be short, only contain lowercase letters, numbers, dots, and dashes. Every slug can only be used once. This is being used in URLs to refer to your organizer accounts and your events.', unique=True, validators=[django.core.validators.RegexValidator(message='The slug may only contain letters, numbers, dots and dashes.', regex='^[a-zA-Z0-9.-]+$'), pretix.base.validators.OrganizerSlugBlacklistValidator()], verbose_name='Short form'),
+        ),
+        migrations.AlterField(
+            model_name='staffsession',
+            name='user',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AlterField(
+            model_name='staffsessionauditlog',
+            name='impersonating',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AlterField(
+            model_name='staffsessionauditlog',
+            name='session',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='logs', to='pretixbase.StaffSession'),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='locale',
+            field=models.CharField(choices=[('en', 'English'), ('de', 'German'), ('de-informal', 'German (informal)'), ('nl', 'Dutch'), ('da', 'Danish'), ('tr', 'Turkish'), ('pt-br', 'Portuguese (Brazil)')], default='en', max_length=50, verbose_name='Language'),
+        ),
+        migrations.AlterUniqueTogether(
+            name='event',
+            unique_together={('organizer', 'slug')},
+        ),
+    ]
diff --git a/src/pretix/base/models/auth.py b/src/pretix/base/models/auth.py
index 541e9f129..eaed7e10f 100644
--- a/src/pretix/base/models/auth.py
+++ b/src/pretix/base/models/auth.py
@@ -340,7 +340,7 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
 
 
 class StaffSession(models.Model):
-    user = models.ForeignKey('User')
+    user = models.ForeignKey('User', on_delete=models.PROTECT)
     date_start = models.DateTimeField(auto_now_add=True)
     date_end = models.DateTimeField(null=True, blank=True)
     session_key = models.CharField(max_length=255)
@@ -351,11 +351,11 @@ class StaffSession(models.Model):
 
 
 class StaffSessionAuditLog(models.Model):
-    session = models.ForeignKey('StaffSession', related_name='logs')
+    session = models.ForeignKey('StaffSession', related_name='logs', on_delete=models.PROTECT)
     datetime = models.DateTimeField(auto_now_add=True)
     url = models.CharField(max_length=255)
     method = models.CharField(max_length=255)
-    impersonating = models.ForeignKey('User', null=True, blank=True)
+    impersonating = models.ForeignKey('User', null=True, blank=True, on_delete=models.PROTECT)
 
     class Meta:
         ordering = ('datetime',)
diff --git a/src/pretix/base/models/checkin.py b/src/pretix/base/models/checkin.py
index a75d52573..c6bab9e3d 100644
--- a/src/pretix/base/models/checkin.py
+++ b/src/pretix/base/models/checkin.py
@@ -8,12 +8,12 @@ from pretix.base.models import LoggedModel
 
 
 class CheckinList(LoggedModel):
-    event = models.ForeignKey('Event', related_name='checkin_lists')
+    event = models.ForeignKey('Event', related_name='checkin_lists', on_delete=models.CASCADE)
     name = models.CharField(max_length=190)
     all_products = models.BooleanField(default=True, verbose_name=_("All products (including newly created ones)"))
     limit_products = models.ManyToManyField('Item', verbose_name=_("Limit to products"), blank=True)
     subevent = models.ForeignKey('SubEvent', null=True, blank=True,
-                                 verbose_name=pgettext_lazy('subevent', 'Date'))
+                                 verbose_name=pgettext_lazy('subevent', 'Date'), on_delete=models.CASCADE)
     include_pending = models.BooleanField(verbose_name=pgettext_lazy('checkin', 'Include pending orders'),
                                           default=False,
                                           help_text=_('With this option, people will be able to check in even if the '
@@ -157,7 +157,7 @@ class Checkin(models.Model):
     """
     A check-in object is created when a person enters the event.
     """
-    position = models.ForeignKey('pretixbase.OrderPosition', related_name='checkins')
+    position = models.ForeignKey('pretixbase.OrderPosition', related_name='checkins', on_delete=models.CASCADE)
     datetime = models.DateTimeField(default=now)
     nonce = models.CharField(max_length=190, null=True, blank=True)
     list = models.ForeignKey(
diff --git a/src/pretix/base/models/event.py b/src/pretix/base/models/event.py
index 0f058fb45..7568fc9a9 100644
--- a/src/pretix/base/models/event.py
+++ b/src/pretix/base/models/event.py
@@ -265,6 +265,7 @@ class Event(EventMixin, LoggedModel):
         verbose_name = _("Event")
         verbose_name_plural = _("Events")
         ordering = ("date_from", "name")
+        unique_together = (('organizer', 'slug'),)
 
     def __str__(self):
         return str(self.name)
diff --git a/src/pretix/base/models/invoices.py b/src/pretix/base/models/invoices.py
index 76feb602f..8b9962dd1 100644
--- a/src/pretix/base/models/invoices.py
+++ b/src/pretix/base/models/invoices.py
@@ -64,14 +64,14 @@ class Invoice(models.Model):
     :param file: The filename of the rendered invoice
     :type file: File
     """
-    order = models.ForeignKey('Order', related_name='invoices', db_index=True)
+    order = models.ForeignKey('Order', related_name='invoices', db_index=True, on_delete=models.CASCADE)
     organizer = models.ForeignKey('Organizer', related_name='invoices', db_index=True, on_delete=models.PROTECT)
-    event = models.ForeignKey('Event', related_name='invoices', db_index=True)
+    event = models.ForeignKey('Event', related_name='invoices', db_index=True, on_delete=models.CASCADE)
     prefix = models.CharField(max_length=160, db_index=True)
     invoice_no = models.CharField(max_length=19, db_index=True)
     full_invoice_no = models.CharField(max_length=190, db_index=True)
     is_cancellation = models.BooleanField(default=False)
-    refers = models.ForeignKey('Invoice', related_name='refered', null=True, blank=True)
+    refers = models.ForeignKey('Invoice', related_name='refered', null=True, blank=True, on_delete=models.CASCADE)
     invoice_from = models.TextField()
     invoice_to = models.TextField()
     date = models.DateField(default=today)
@@ -175,7 +175,7 @@ class InvoiceLine(models.Model):
     :param tax_name: The name of the applied tax rate
     :type tax_name: str
     """
-    invoice = models.ForeignKey('Invoice', related_name='lines')
+    invoice = models.ForeignKey('Invoice', related_name='lines', on_delete=models.CASCADE)
     position = models.PositiveIntegerField(default=0)
     description = models.TextField()
     gross_value = models.DecimalField(max_digits=10, decimal_places=2)
diff --git a/src/pretix/base/models/items.py b/src/pretix/base/models/items.py
index 54087a9e6..38bc7d9ff 100644
--- a/src/pretix/base/models/items.py
+++ b/src/pretix/base/models/items.py
@@ -447,7 +447,8 @@ class ItemVariation(models.Model):
     """
     item = models.ForeignKey(
         Item,
-        related_name='variations'
+        related_name='variations',
+        on_delete=models.CASCADE
     )
     value = I18nCharField(
         max_length=255,
@@ -562,12 +563,14 @@ class ItemAddOn(models.Model):
     """
     base_item = models.ForeignKey(
         Item,
-        related_name='addons'
+        related_name='addons',
+        on_delete=models.CASCADE
     )
     addon_category = models.ForeignKey(
         ItemCategory,
         related_name='addon_to',
-        verbose_name=_('Category')
+        verbose_name=_('Category'),
+        on_delete=models.CASCADE
     )
     min_count = models.PositiveIntegerField(
         default=0,
@@ -679,7 +682,8 @@ class Question(LoggedModel):
 
     event = models.ForeignKey(
         Event,
-        related_name="questions"
+        related_name="questions",
+        on_delete=models.CASCADE
     )
     question = I18nTextField(
         verbose_name=_("Question")
@@ -831,7 +835,7 @@ class Question(LoggedModel):
 
 
 class QuestionOption(models.Model):
-    question = models.ForeignKey('Question', related_name='options')
+    question = models.ForeignKey('Question', related_name='options', on_delete=models.CASCADE)
     identifier = models.CharField(max_length=190)
     answer = I18nCharField(verbose_name=_('Answer'))
     position = models.IntegerField(default=0)
diff --git a/src/pretix/base/models/orders.py b/src/pretix/base/models/orders.py
index 4b0fd8923..10557354c 100644
--- a/src/pretix/base/models/orders.py
+++ b/src/pretix/base/models/orders.py
@@ -119,7 +119,8 @@ class Order(LoggedModel):
     event = models.ForeignKey(
         Event,
         verbose_name=_("Event"),
-        related_name="orders"
+        related_name="orders",
+        on_delete=models.CASCADE
     )
     email = models.EmailField(
         null=True, blank=True,
@@ -226,11 +227,11 @@ class Order(LoggedModel):
             pending_sum_rc=-1 * F('payment_sum') + Coalesce(F('refund_sum'), 0),
         ).annotate(
             is_overpaid=Case(
-                When(~Q(status__in=[Order.STATUS_REFUNDED, Order.STATUS_CANCELED]) & Q(pending_sum_t__lt=0),
+                When(~Q(status__in=(Order.STATUS_REFUNDED, Order.STATUS_CANCELED)) & Q(pending_sum_t__lt=0),
                      then=Value('1')),
-                When(Q(status__in=[Order.STATUS_REFUNDED, Order.STATUS_CANCELED]) & Q(pending_sum_rc__lt=0),
+                When(Q(status__in=(Order.STATUS_REFUNDED, Order.STATUS_CANCELED)) & Q(pending_sum_rc__lt=0),
                      then=Value('1')),
-                When(Q(status__in=[Order.STATUS_EXPIRED, Order.STATUS_PENDING]) & Q(pending_sum_t__lte=0),
+                When(Q(status__in=(Order.STATUS_EXPIRED, Order.STATUS_PENDING)) & Q(pending_sum_t__lte=0),
                      then=Value('1')),
                 default=Value('0'),
                 output_field=models.IntegerField()
@@ -544,14 +545,14 @@ class QuestionAnswer(models.Model):
     """
     orderposition = models.ForeignKey(
         'OrderPosition', null=True, blank=True,
-        related_name='answers'
+        related_name='answers', on_delete=models.CASCADE
     )
     cartposition = models.ForeignKey(
         'CartPosition', null=True, blank=True,
-        related_name='answers'
+        related_name='answers', on_delete=models.CASCADE
     )
     question = models.ForeignKey(
-        Question, related_name='answers'
+        Question, related_name='answers', on_delete=models.CASCADE
     )
     options = models.ManyToManyField(
         QuestionOption, related_name='answers', blank=True
@@ -699,7 +700,7 @@ class AbstractPosition(models.Model):
         help_text=_("Empty, if this product is not an admission ticket")
     )
     voucher = models.ForeignKey(
-        'Voucher', null=True, blank=True
+        'Voucher', null=True, blank=True, on_delete=models.CASCADE
     )
     addon_to = models.ForeignKey(
         'self', null=True, blank=True, on_delete=models.CASCADE, related_name='addons'
@@ -829,7 +830,7 @@ class OrderPayment(models.Model):
     )
     fee = models.ForeignKey(
         'OrderFee',
-        null=True, blank=True, related_name='payments'
+        null=True, blank=True, related_name='payments', on_delete=models.SET_NULL
     )
     migrated = models.BooleanField(default=False)
 
@@ -1444,7 +1445,8 @@ class CartPosition(AbstractPosition):
     """
     event = models.ForeignKey(
         Event,
-        verbose_name=_("Event")
+        verbose_name=_("Event"),
+        on_delete=models.CASCADE
     )
     cart_id = models.CharField(
         max_length=255, null=True, blank=True, db_index=True,
@@ -1488,7 +1490,7 @@ class CartPosition(AbstractPosition):
 
 class InvoiceAddress(models.Model):
     last_modified = models.DateTimeField(auto_now=True)
-    order = models.OneToOneField(Order, null=True, blank=True, related_name='invoice_address')
+    order = models.OneToOneField(Order, null=True, blank=True, related_name='invoice_address', on_delete=models.CASCADE)
     is_business = models.BooleanField(default=False, verbose_name=_('Business customer'))
     company = models.CharField(max_length=255, blank=True, verbose_name=_('Company name'))
     name = models.CharField(max_length=255, verbose_name=_('Full name'), blank=True)
diff --git a/src/pretix/base/models/organizer.py b/src/pretix/base/models/organizer.py
index bffa2da80..d76c7f4d0 100644
--- a/src/pretix/base/models/organizer.py
+++ b/src/pretix/base/models/organizer.py
@@ -42,6 +42,7 @@ class Organizer(LoggedModel):
             OrganizerSlugBlacklistValidator()
         ],
         verbose_name=_("Short form"),
+        unique=True
     )
 
     class Meta:
diff --git a/src/pretix/base/models/tax.py b/src/pretix/base/models/tax.py
index 13a7d9b8e..ca9a91db0 100644
--- a/src/pretix/base/models/tax.py
+++ b/src/pretix/base/models/tax.py
@@ -60,7 +60,7 @@ EU_CURRENCIES = {
 
 
 class TaxRule(LoggedModel):
-    event = models.ForeignKey('Event', related_name='tax_rules')
+    event = models.ForeignKey('Event', related_name='tax_rules', on_delete=models.CASCADE)
     name = I18nCharField(
         verbose_name=_('Name'),
         help_text=_('Should be short, e.g. "VAT"'),
diff --git a/src/pretix/base/models/vouchers.py b/src/pretix/base/models/vouchers.py
index 34991aa5b..c309c4768 100644
--- a/src/pretix/base/models/vouchers.py
+++ b/src/pretix/base/models/vouchers.py
@@ -137,14 +137,14 @@ class Voucher(LoggedModel):
     item = models.ForeignKey(
         Item, related_name='vouchers',
         verbose_name=_("Product"),
-        null=True, blank=True,
+        null=True, blank=True, on_delete=models.CASCADE,
         help_text=_(
             "This product is added to the user's cart if the voucher is redeemed."
         )
     )
     variation = models.ForeignKey(
         ItemVariation, related_name='vouchers',
-        null=True, blank=True,
+        null=True, blank=True, on_delete=models.CASCADE,
         verbose_name=_("Product variation"),
         help_text=_(
             "This variation of the product select above is being used."
@@ -152,7 +152,7 @@ class Voucher(LoggedModel):
     )
     quota = models.ForeignKey(
         Quota, related_name='quota',
-        null=True, blank=True,
+        null=True, blank=True, on_delete=models.CASCADE,
         verbose_name=_("Quota"),
         help_text=_(
             "If enabled, the voucher is valid for any product affected by this quota."
diff --git a/src/pretix/base/models/waitinglist.py b/src/pretix/base/models/waitinglist.py
index 51be7dbf5..886b97be7 100644
--- a/src/pretix/base/models/waitinglist.py
+++ b/src/pretix/base/models/waitinglist.py
@@ -43,10 +43,11 @@ class WaitingListEntry(LoggedModel):
         'Voucher',
         verbose_name=_("Assigned voucher"),
         null=True, blank=True,
-        related_name='waitinglistentries'
+        related_name='waitinglistentries',
+        on_delete=models.CASCADE
     )
     item = models.ForeignKey(
-        Item, related_name='waitinglistentries',
+        Item, related_name='waitinglistentries', on_delete=models.CASCADE,
         verbose_name=_("Product"),
         help_text=_(
             "The product the user waits for."
@@ -54,7 +55,7 @@ class WaitingListEntry(LoggedModel):
     )
     variation = models.ForeignKey(
         ItemVariation, related_name='waitinglistentries',
-        null=True, blank=True,
+        null=True, blank=True, on_delete=models.CASCADE,
         verbose_name=_("Product variation"),
         help_text=_(
             "The variation of the product selected above."
diff --git a/src/pretix/base/services/invoices.py b/src/pretix/base/services/invoices.py
index 416574159..da6ed1b78 100644
--- a/src/pretix/base/services/invoices.py
+++ b/src/pretix/base/services/invoices.py
@@ -171,7 +171,7 @@ def build_cancellation(invoice: Invoice):
 
 
 def generate_cancellation(invoice: Invoice, trigger_pdf=True):
-    cancellation = copy.copy(invoice)
+    cancellation = copy.deepcopy(invoice)
     cancellation.pk = None
     cancellation.invoice_no = None
     cancellation.prefix = None
diff --git a/src/pretix/base/services/orders.py b/src/pretix/base/services/orders.py
index f65083353..cbaa646a8 100644
--- a/src/pretix/base/services/orders.py
+++ b/src/pretix/base/services/orders.py
@@ -923,7 +923,7 @@ class OrderChangeManager:
             op.save()
 
         try:
-            ia = copy.copy(self.order.invoice_address)
+            ia = copy.deepcopy(self.order.invoice_address)
             ia.pk = None
             ia.order = split_order
             ia.save()
@@ -947,7 +947,7 @@ class OrderChangeManager:
             split_order.total += fee.value
 
         for fee in self.order.fees.exclude(fee_type=OrderFee.FEE_TYPE_PAYMENT):
-            new_fee = copy.copy(fee)
+            new_fee = copy.deepcopy(fee)
             new_fee.pk = None
             new_fee.order = split_order
             split_order.total += new_fee.value
diff --git a/src/pretix/base/templates/error.html b/src/pretix/base/templates/error.html
index fcb1f223c..ad1e120a7 100644
--- a/src/pretix/base/templates/error.html
+++ b/src/pretix/base/templates/error.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/base/templates/pretixbase/cachedfiles/pending.html b/src/pretix/base/templates/pretixbase/cachedfiles/pending.html
index 36d99aff0..20a37feb7 100644
--- a/src/pretix/base/templates/pretixbase/cachedfiles/pending.html
+++ b/src/pretix/base/templates/pretixbase/cachedfiles/pending.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/base/templatetags/rich_text.py b/src/pretix/base/templatetags/rich_text.py
index 98d543577..6dd00262c 100644
--- a/src/pretix/base/templatetags/rich_text.py
+++ b/src/pretix/base/templatetags/rich_text.py
@@ -63,7 +63,7 @@ ALLOWED_PROTOCOLS = ['http', 'https', 'mailto', 'tel']
 
 def safelink_callback(attrs, new=False):
     url = attrs.get((None, 'href'), '/')
-    if not is_safe_url(url) and not url.startswith('mailto:') and not url.startswith('tel:'):
+    if not is_safe_url(url, allowed_hosts=None) and not url.startswith('mailto:') and not url.startswith('tel:'):
         signer = signing.Signer(salt='safe-redirect')
         attrs[None, 'href'] = reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))
         attrs[None, 'target'] = '_blank'
diff --git a/src/pretix/base/templatetags/urlreplace.py b/src/pretix/base/templatetags/urlreplace.py
index 1dc678570..6a5b4717f 100644
--- a/src/pretix/base/templatetags/urlreplace.py
+++ b/src/pretix/base/templatetags/urlreplace.py
@@ -15,6 +15,6 @@ def url_replace(request, *pairs):
                 if key in dict_:
                     del dict_[key]
             else:
-                dict_[key] = p
+                dict_[key] = str(p)
             key = None
     return dict_.urlencode(safe='[]')
diff --git a/src/pretix/base/views/js_catalog.py b/src/pretix/base/views/js_catalog.py
index b2f475a66..ea315aaec 100644
--- a/src/pretix/base/views/js_catalog.py
+++ b/src/pretix/base/views/js_catalog.py
@@ -1,7 +1,8 @@
 from django.utils import timezone
+from django.utils.translation.trans_real import DjangoTranslation
 from django.views.decorators.cache import cache_page
 from django.views.decorators.http import etag
-from django.views.i18n import get_javascript_catalog, render_javascript_catalog
+from django.views.i18n import JavaScriptCatalog, render_javascript_catalog
 
 # Yes, we want to regenerate this every time the module has been imported to
 # refresh the cache at least at every code deployment
@@ -18,6 +19,6 @@ js_info_dict = {
 @etag(lambda *s, **k: import_date)
 @cache_page(3600, key_prefix='js18n-%s' % import_date)
 def js_catalog(request, lang):
-    packages = ['pretix']
-    catalog, plural = get_javascript_catalog(lang, 'djangojs', packages)
-    return render_javascript_catalog(catalog, plural)
+    c = JavaScriptCatalog()
+    c.translation = DjangoTranslation(lang, domain='djangojs')
+    return render_javascript_catalog(c.get_catalog(), c.get_plural())
diff --git a/src/pretix/base/views/redirect.py b/src/pretix/base/views/redirect.py
index ad58bec3c..bc17f943c 100644
--- a/src/pretix/base/views/redirect.py
+++ b/src/pretix/base/views/redirect.py
@@ -1,8 +1,8 @@
 import urllib.parse
 
 from django.core import signing
-from django.core.urlresolvers import reverse
 from django.http import HttpResponseBadRequest, HttpResponseRedirect
+from django.urls import reverse
 
 
 def redir_view(request):
diff --git a/src/pretix/control/context.py b/src/pretix/control/context.py
index 2a6c2e299..d09a11fd5 100644
--- a/src/pretix/control/context.py
+++ b/src/pretix/control/context.py
@@ -2,8 +2,8 @@ import sys
 from importlib import import_module
 
 from django.conf import settings
-from django.core.urlresolvers import Resolver404, get_script_prefix, resolve
 from django.db.models import Q
+from django.urls import Resolver404, get_script_prefix, resolve
 from django.utils.translation import get_language
 
 from pretix.base.models.auth import StaffSession
diff --git a/src/pretix/control/forms/item.py b/src/pretix/control/forms/item.py
index 77a1f0395..f8438aeaf 100644
--- a/src/pretix/control/forms/item.py
+++ b/src/pretix/control/forms/item.py
@@ -78,7 +78,7 @@ class QuotaForm(I18nModelForm):
         self.instance = kwargs.get('instance', None)
         self.event = kwargs.get('event')
         items = kwargs.pop('items', None) or self.event.items.prefetch_related('variations')
-        self.original_instance = copy.copy(self.instance) if self.instance else None
+        self.original_instance = copy.deepcopy(self.instance) if self.instance else None
         initial = kwargs.get('initial', {})
         if self.instance and self.instance.pk:
             initial['itemvars'] = [str(i.pk) for i in self.instance.items.all()] + [
@@ -370,6 +370,7 @@ class ItemVariationsFormSet(I18nFormSet):
             auto_id=self.auto_id,
             prefix=self.add_prefix('__prefix__'),
             empty_permitted=True,
+            use_required_attribute=False,
             locales=self.locales,
             event=self.event
         )
@@ -430,6 +431,7 @@ class ItemAddOnsFormSet(I18nFormSet):
             auto_id=self.auto_id,
             prefix=self.add_prefix('__prefix__'),
             empty_permitted=True,
+            use_required_attribute=False,
             locales=self.locales,
             event=self.event
         )
diff --git a/src/pretix/control/forms/subevents.py b/src/pretix/control/forms/subevents.py
index 219b2a670..f933e0c4d 100644
--- a/src/pretix/control/forms/subevents.py
+++ b/src/pretix/control/forms/subevents.py
@@ -150,6 +150,7 @@ class QuotaFormSet(I18nInlineFormSet):
             auto_id=self.auto_id,
             prefix=self.add_prefix('__prefix__'),
             empty_permitted=True,
+            use_required_attribute=False,
             locales=self.locales,
             event=self.event,
             items=self.items
@@ -196,6 +197,7 @@ class CheckinListFormSet(I18nInlineFormSet):
             auto_id=self.auto_id,
             prefix=self.add_prefix('__prefix__'),
             empty_permitted=True,
+            use_required_attribute=False,
             event=self.event,
         )
         self.add_fields(form, None)
diff --git a/src/pretix/control/forms/vouchers.py b/src/pretix/control/forms/vouchers.py
index 55a4b34dc..e231f5111 100644
--- a/src/pretix/control/forms/vouchers.py
+++ b/src/pretix/control/forms/vouchers.py
@@ -45,7 +45,7 @@ class VoucherForm(I18nModelForm):
         instance = kwargs.get('instance')
         initial = kwargs.get('initial')
         if instance:
-            self.initial_instance_data = copy.copy(instance)
+            self.initial_instance_data = copy.deepcopy(instance)
             try:
                 if instance.variation:
                     initial['itemvar'] = '%d-%d' % (instance.item.pk, instance.variation.pk)
@@ -139,7 +139,7 @@ class VoucherForm(I18nModelForm):
 
         if 'codes' in data:
             data['codes'] = [a.strip() for a in data.get('codes', '').strip().split("\n") if a]
-            cnt = len(data['codes']) * data['max_usages']
+            cnt = len(data['codes']) * data.get('max_usages', 0)
         else:
             cnt = data['max_usages']
 
@@ -217,7 +217,7 @@ class VoucherBulkForm(VoucherForm):
     def save(self, event, *args, **kwargs):
         objs = []
         for code in self.cleaned_data['codes']:
-            obj = copy.copy(self.instance)
+            obj = copy.deepcopy(self.instance)
             obj.event = event
             obj.code = code
             data = dict(self.cleaned_data)
diff --git a/src/pretix/control/middleware.py b/src/pretix/control/middleware.py
index cd99705ef..45d07d1a3 100644
--- a/src/pretix/control/middleware.py
+++ b/src/pretix/control/middleware.py
@@ -2,9 +2,9 @@ from urllib.parse import quote, urljoin, urlparse
 
 from django.conf import settings
 from django.contrib.auth import REDIRECT_FIELD_NAME, logout
-from django.core.urlresolvers import get_script_prefix, resolve, reverse
 from django.http import Http404
 from django.shortcuts import get_object_or_404, redirect, resolve_url
+from django.urls import get_script_prefix, resolve, reverse
 from django.utils.deprecation import MiddlewareMixin
 from django.utils.encoding import force_str
 from django.utils.translation import ugettext as _
diff --git a/src/pretix/control/templates/pretixcontrol/auth/base.html b/src/pretix/control/templates/pretixcontrol/auth/base.html
index 7cf1fa0c8..54e15129d 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/base.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/base.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/control/templates/pretixcontrol/auth/forgot.html b/src/pretix/control/templates/pretixcontrol/auth/forgot.html
index 3140a8497..7e456284b 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/forgot.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/forgot.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% block content %}
 	<form class="form-signin" action="" method="post">
diff --git a/src/pretix/control/templates/pretixcontrol/auth/invite.html b/src/pretix/control/templates/pretixcontrol/auth/invite.html
index b10a5a563..a4a4c3ab3 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/invite.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/invite.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% block content %}
 	<form class="form-signin" action="" method="post">
diff --git a/src/pretix/control/templates/pretixcontrol/auth/login.html b/src/pretix/control/templates/pretixcontrol/auth/login.html
index 75f5518e2..a51f18f9d 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/login.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/login.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% block content %}
     <form class="form-signin" action="" method="post">
         {% bootstrap_form_errors form type='all' layout='inline' %}
diff --git a/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html b/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html
index e06e531b4..6c5c73aa8 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load compress %}
 {% block content %}
     <form class="form-signin" action="" method="post" id="u2f-form">
diff --git a/src/pretix/control/templates/pretixcontrol/auth/oauth_authorization.html b/src/pretix/control/templates/pretixcontrol/auth/oauth_authorization.html
index e592488a0..3dc000903 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/oauth_authorization.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/oauth_authorization.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% block content %}
     {% if not error %}
diff --git a/src/pretix/control/templates/pretixcontrol/auth/recover.html b/src/pretix/control/templates/pretixcontrol/auth/recover.html
index 2ff140d0d..1caf09032 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/recover.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/recover.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% block content %}
 	<form class="form-signin" action="" method="post">
diff --git a/src/pretix/control/templates/pretixcontrol/auth/register.html b/src/pretix/control/templates/pretixcontrol/auth/register.html
index 4d2e0646b..4deee0d01 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/register.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/register.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% block content %}
 	<form class="form-signin" action="" method="post">
diff --git a/src/pretix/control/templates/pretixcontrol/base.html b/src/pretix/control/templates/pretixcontrol/base.html
index 764684016..21af5a2a6 100644
--- a/src/pretix/control/templates/pretixcontrol/base.html
+++ b/src/pretix/control/templates/pretixcontrol/base.html
@@ -1,5 +1,5 @@
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% load hijack_tags %}
 {% load statici18n %}
diff --git a/src/pretix/control/templates/pretixcontrol/event/base.html b/src/pretix/control/templates/pretixcontrol/event/base.html
index d2fa47e8f..2ce387c4f 100644
--- a/src/pretix/control/templates/pretixcontrol/event/base.html
+++ b/src/pretix/control/templates/pretixcontrol/event/base.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% block title %}{{ request.event.name }}{% endblock %}
 
 {% block nav %}
diff --git a/src/pretix/control/templates/pretixcontrol/event/index.html b/src/pretix/control/templates/pretixcontrol/event/index.html
index 84fa72920..c391b78a2 100644
--- a/src/pretix/control/templates/pretixcontrol/event/index.html
+++ b/src/pretix/control/templates/pretixcontrol/event/index.html
@@ -2,7 +2,7 @@
 {% load i18n %}
 {% load eventurl %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% block title %}{{ request.event.name }}{% endblock %}
 {% block content %}
     <h1>
diff --git a/src/pretix/control/templates/pretixcontrol/event/logs.html b/src/pretix/control/templates/pretixcontrol/event/logs.html
index 3c8555b66..3ad186eaa 100644
--- a/src/pretix/control/templates/pretixcontrol/event/logs.html
+++ b/src/pretix/control/templates/pretixcontrol/event/logs.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/items/base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% block title %}{% trans "Event logs" %}{% endblock %}
 {% block inside %}
     <h1>{% trans "Event logs" %}</h1>
diff --git a/src/pretix/control/templates/pretixcontrol/event/permissions.html b/src/pretix/control/templates/pretixcontrol/event/permissions.html
index c7ccc6748..4a7d8cb1b 100644
--- a/src/pretix/control/templates/pretixcontrol/event/permissions.html
+++ b/src/pretix/control/templates/pretixcontrol/event/permissions.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/event/settings_base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load bootstrap3 %}
 {% block inside %}
 
diff --git a/src/pretix/control/templates/pretixcontrol/event/widget.html b/src/pretix/control/templates/pretixcontrol/event/widget.html
index 737ba60d1..fd36ce4cd 100644
--- a/src/pretix/control/templates/pretixcontrol/event/widget.html
+++ b/src/pretix/control/templates/pretixcontrol/event/widget.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/event/settings_base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load bootstrap3 %}
 {% load eventurl %}
 {% load eventsignal %}
diff --git a/src/pretix/control/templates/pretixcontrol/includes/logs.html b/src/pretix/control/templates/pretixcontrol/includes/logs.html
index 624efb8ce..aa2c4ad33 100644
--- a/src/pretix/control/templates/pretixcontrol/includes/logs.html
+++ b/src/pretix/control/templates/pretixcontrol/includes/logs.html
@@ -1,4 +1,4 @@
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 <ul class="list-group">
     {% for log in obj.all_logentries %}
diff --git a/src/pretix/control/templates/pretixcontrol/pdf/index.html b/src/pretix/control/templates/pretixcontrol/pdf/index.html
index 893b0d227..f18f06097 100644
--- a/src/pretix/control/templates/pretixcontrol/pdf/index.html
+++ b/src/pretix/control/templates/pretixcontrol/pdf/index.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/event/base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load compress %}
 {% block title %}{% trans "PDF Editor" %}{% endblock %}
 {% block custom_header %}
diff --git a/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css b/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css
index 5224391b8..438883da1 100644
--- a/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css
+++ b/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css
@@ -1,4 +1,4 @@
-{% load staticfiles %}
+{% load static %}
 
 {% for family, styles in fonts.items %}
 {% for style, formats in styles.items %}
diff --git a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_u2f.html b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_u2f.html
index 896507392..1f9980043 100644
--- a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_u2f.html
+++ b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_u2f.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load compress %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
diff --git a/src/pretix/control/templates/pretixcontrol/user/reauth.html b/src/pretix/control/templates/pretixcontrol/user/reauth.html
index 4cc6297dd..f1a942204 100644
--- a/src/pretix/control/templates/pretixcontrol/user/reauth.html
+++ b/src/pretix/control/templates/pretixcontrol/user/reauth.html
@@ -2,7 +2,7 @@
 {% load i18n %}
 {% load bootstrap3 %}
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 {% block content %}
     <form class="form-signin" id="u2f-form" action="" method="post">
         {% csrf_token %}
diff --git a/src/pretix/control/views/auth.py b/src/pretix/control/views/auth.py
index 2982ab7fb..f1a3916db 100644
--- a/src/pretix/control/views/auth.py
+++ b/src/pretix/control/views/auth.py
@@ -48,13 +48,13 @@ def login(request):
                 request.session['pretix_auth_2fa_user'] = form.user_cache.pk
                 request.session['pretix_auth_2fa_time'] = str(int(time.time()))
                 twofa_url = reverse('control:auth.login.2fa')
-                if "next" in request.GET and is_safe_url(request.GET.get("next")):
+                if "next" in request.GET and is_safe_url(request.GET.get("next"), allowed_hosts=None):
                     twofa_url += '?next=' + quote(request.GET.get('next'))
                 return redirect(twofa_url)
             else:
                 auth_login(request, form.user_cache)
                 request.session['pretix_auth_login_time'] = int(time.time())
-                if "next" in request.GET and is_safe_url(request.GET.get("next")):
+                if "next" in request.GET and is_safe_url(request.GET.get("next"), allowed_hosts=None):
                     return redirect(request.GET.get("next"))
                 return redirect(reverse('control:index'))
     else:
@@ -72,7 +72,7 @@ def logout(request):
     auth_logout(request)
     request.session['pretix_auth_login_time'] = 0
     next = reverse('control:auth.login')
-    if 'next' in request.GET and is_safe_url(request.GET.get('next')):
+    if 'next' in request.GET and is_safe_url(request.GET.get('next'), allowed_hosts=None):
         next += '?next=' + quote(request.GET.get('next'))
     return redirect(next)
 
@@ -94,7 +94,7 @@ def register(request):
                 locale=request.LANGUAGE_CODE,
                 timezone=request.timezone if hasattr(request, 'timezone') else settings.TIME_ZONE
             )
-            user = authenticate(email=user.email, password=form.cleaned_data['password'])
+            user = authenticate(request=request, email=user.email, password=form.cleaned_data['password'])
             user.log_action('pretix.control.auth.user.created', user=user)
             auth_login(request, user)
             request.session['pretix_auth_login_time'] = int(time.time())
@@ -148,7 +148,7 @@ def invite(request, token):
                 locale=request.LANGUAGE_CODE,
                 timezone=request.timezone if hasattr(request, 'timezone') else settings.TIME_ZONE
             )
-            user = authenticate(email=user.email, password=form.cleaned_data['password'])
+            user = authenticate(request=request, email=user.email, password=form.cleaned_data['password'])
             user.log_action('pretix.control.auth.user.created', user=user)
             auth_login(request, user)
             request.session['pretix_auth_login_time'] = int(time.time())
@@ -329,7 +329,7 @@ class Login2FAView(TemplateView):
             request.session['pretix_auth_login_time'] = int(time.time())
             del request.session['pretix_auth_2fa_user']
             del request.session['pretix_auth_2fa_time']
-            if "next" in request.GET and is_safe_url(request.GET.get("next")):
+            if "next" in request.GET and is_safe_url(request.GET.get("next"), allowed_hosts=None):
                 return redirect(request.GET.get("next"))
             return redirect(reverse('control:index'))
         else:
diff --git a/src/pretix/control/views/checkin.py b/src/pretix/control/views/checkin.py
index 74ec3035f..d5d41e9b2 100644
--- a/src/pretix/control/views/checkin.py
+++ b/src/pretix/control/views/checkin.py
@@ -1,10 +1,10 @@
 import dateutil.parser
 from django.contrib import messages
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import Max, OuterRef, Subquery
 from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import get_object_or_404, redirect
+from django.urls import reverse
 from django.utils.functional import cached_property
 from django.utils.timezone import is_aware, make_aware, now
 from django.utils.translation import ugettext_lazy as _
diff --git a/src/pretix/control/views/dashboards.py b/src/pretix/control/views/dashboards.py
index 2790f2153..0205ce609 100644
--- a/src/pretix/control/views/dashboards.py
+++ b/src/pretix/control/views/dashboards.py
@@ -2,7 +2,6 @@ from decimal import Decimal
 
 import pytz
 from django.contrib.contenttypes.models import ContentType
-from django.core.urlresolvers import reverse
 from django.db.models import (
     Count, Exists, IntegerField, Max, Min, OuterRef, Q, Subquery, Sum,
 )
@@ -10,6 +9,7 @@ from django.db.models.functions import Coalesce, Greatest
 from django.dispatch import receiver
 from django.shortcuts import render
 from django.template.loader import get_template
+from django.urls import reverse
 from django.utils import formats
 from django.utils.formats import date_format
 from django.utils.html import escape
diff --git a/src/pretix/control/views/event.py b/src/pretix/control/views/event.py
index cc14ab35a..3d9a7a0ea 100644
--- a/src/pretix/control/views/event.py
+++ b/src/pretix/control/views/event.py
@@ -9,7 +9,6 @@ from django.conf import settings
 from django.contrib import messages
 from django.contrib.contenttypes.models import ContentType
 from django.core.files import File
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import ProtectedError
 from django.http import (
@@ -17,6 +16,7 @@ from django.http import (
     JsonResponse,
 )
 from django.shortcuts import get_object_or_404, redirect
+from django.urls import reverse
 from django.utils import translation
 from django.utils.formats import date_format
 from django.utils.functional import cached_property
diff --git a/src/pretix/control/views/item.py b/src/pretix/control/views/item.py
index a0fffabf2..b5a9d6511 100644
--- a/src/pretix/control/views/item.py
+++ b/src/pretix/control/views/item.py
@@ -2,12 +2,12 @@ import json
 
 from django.contrib import messages
 from django.core.files import File
-from django.core.urlresolvers import resolve, reverse
 from django.db import transaction
 from django.db.models import Count, F, Q
 from django.forms.models import inlineformset_factory
 from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import redirect
+from django.urls import resolve, reverse
 from django.utils.functional import cached_property
 from django.utils.timezone import now
 from django.utils.translation import ugettext, ugettext_lazy as _
diff --git a/src/pretix/control/views/main.py b/src/pretix/control/views/main.py
index ad4d6f058..1a79be961 100644
--- a/src/pretix/control/views/main.py
+++ b/src/pretix/control/views/main.py
@@ -1,5 +1,4 @@
 from django.conf import settings
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import (
     F, IntegerField, Max, Min, OuterRef, Prefetch, Subquery, Sum,
@@ -7,6 +6,7 @@ from django.db.models import (
 from django.db.models.functions import Coalesce, Greatest
 from django.http import JsonResponse
 from django.shortcuts import redirect
+from django.urls import reverse
 from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
 from django.utils.translation import ugettext, ugettext_lazy as _
diff --git a/src/pretix/control/views/orders.py b/src/pretix/control/views/orders.py
index 2cb360466..a2daa5ed8 100644
--- a/src/pretix/control/views/orders.py
+++ b/src/pretix/control/views/orders.py
@@ -10,11 +10,11 @@ import vat_moss.id
 from django.conf import settings
 from django.contrib import messages
 from django.core.files import File
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import Count
 from django.http import FileResponse, Http404, HttpResponseNotAllowed
 from django.shortcuts import get_object_or_404, redirect, render
+from django.urls import reverse
 from django.utils import formats
 from django.utils.formats import date_format
 from django.utils.functional import cached_property
@@ -275,7 +275,7 @@ class OrderRefundCancel(OrderView):
             messages.success(self.request, _('The refund has been canceled.'))
         else:
             messages.error(self.request, _('This refund can not be canceled at the moment.'))
-        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next")):
+        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next"), allowed_hosts=None):
             return redirect(self.request.GET.get("next"))
         return redirect(self.get_order_url())
 
@@ -310,7 +310,7 @@ class OrderRefundProcess(OrderView):
             messages.success(self.request, _('The refund has been processed.'))
         else:
             messages.error(self.request, _('This refund can not be processed at the moment.'))
-        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next")):
+        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next"), allowed_hosts=None):
             return redirect(self.request.GET.get("next"))
         return redirect(self.get_order_url())
 
@@ -336,7 +336,7 @@ class OrderRefundDone(OrderView):
             messages.success(self.request, _('The refund has been marked as done.'))
         else:
             messages.error(self.request, _('This refund can not be processed at the moment.'))
-        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next")):
+        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next"), allowed_hosts=None):
             return redirect(self.request.GET.get("next"))
         return redirect(self.get_order_url())
 
diff --git a/src/pretix/control/views/organizer.py b/src/pretix/control/views/organizer.py
index c8c07969e..8cc01ef63 100644
--- a/src/pretix/control/views/organizer.py
+++ b/src/pretix/control/views/organizer.py
@@ -2,11 +2,11 @@ from django import forms
 from django.contrib import messages
 from django.core.exceptions import PermissionDenied
 from django.core.files import File
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import Count
 from django.forms import inlineformset_factory
 from django.shortcuts import get_object_or_404, redirect
+from django.urls import reverse
 from django.utils.functional import cached_property
 from django.utils.translation import ugettext_lazy as _
 from django.views.generic import (
diff --git a/src/pretix/control/views/subevents.py b/src/pretix/control/views/subevents.py
index a7924049e..be98112d4 100644
--- a/src/pretix/control/views/subevents.py
+++ b/src/pretix/control/views/subevents.py
@@ -3,13 +3,13 @@ from datetime import datetime
 
 from dateutil.rrule import DAILY, MONTHLY, WEEKLY, YEARLY, rrule, rruleset
 from django.contrib import messages
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import F, IntegerField, OuterRef, Prefetch, Subquery, Sum
 from django.db.models.functions import Coalesce
 from django.forms import inlineformset_factory
 from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import redirect, render
+from django.urls import reverse
 from django.utils.functional import cached_property
 from django.utils.timezone import make_aware
 from django.utils.translation import pgettext_lazy, ugettext_lazy as _
@@ -424,7 +424,7 @@ class SubEventCreate(SubEventEditorMixin, EventPermissionRequiredMixin, CreateVi
         kwargs = super().get_form_kwargs()
         kwargs['event'] = self.request.event
         if self.copy_from:
-            i = copy.copy(self.copy_from)
+            i = copy.deepcopy(self.copy_from)
             i.pk = None
             kwargs['instance'] = i
         else:
diff --git a/src/pretix/control/views/user.py b/src/pretix/control/views/user.py
index a1d1066b4..ab92692c7 100644
--- a/src/pretix/control/views/user.py
+++ b/src/pretix/control/views/user.py
@@ -7,8 +7,8 @@ from urllib.parse import quote
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import update_session_auth_hash
-from django.core.urlresolvers import reverse
 from django.shortcuts import get_object_or_404, redirect
+from django.urls import reverse
 from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
 from django.utils.http import is_safe_url
@@ -73,7 +73,7 @@ class ReauthView(TemplateView):
             t = int(time.time())
             request.session['pretix_auth_login_time'] = t
             request.session['pretix_auth_last_used'] = t
-            if "next" in request.GET and is_safe_url(request.GET.get("next")):
+            if "next" in request.GET and is_safe_url(request.GET.get("next"), allowed_hosts=None):
                 return redirect(request.GET.get("next"))
             return redirect(reverse('control:index'))
         else:
@@ -544,7 +544,7 @@ class StartStaffSession(StaffMemberRequiredMixin, RecentAuthenticationRequiredMi
                 session_key=request.session.session_key
             )
 
-        if "next" in request.GET and is_safe_url(request.GET.get("next")):
+        if "next" in request.GET and is_safe_url(request.GET.get("next"), allowed_hosts=None):
             return redirect(request.GET.get("next"))
         else:
             return redirect(reverse("control:index"))
diff --git a/src/pretix/control/views/users.py b/src/pretix/control/views/users.py
index 757cc4094..e16682e6d 100644
--- a/src/pretix/control/views/users.py
+++ b/src/pretix/control/views/users.py
@@ -1,13 +1,16 @@
 from django.conf import settings
 from django.contrib import messages
+from django.contrib.auth import get_user_model
 from django.contrib.auth.mixins import LoginRequiredMixin
-from django.shortcuts import get_object_or_404, redirect
+from django.core.exceptions import PermissionDenied
+from django.http import HttpResponseRedirect
+from django.shortcuts import get_object_or_404, redirect, resolve_url
 from django.urls import reverse
 from django.utils.functional import cached_property
+from django.utils.http import is_safe_url
 from django.utils.translation import ugettext_lazy as _
 from django.views import View
 from django.views.generic import ListView
-from hijack.helpers import login_user, release_hijack
 
 from pretix.base.models import User
 from pretix.base.services.mail import SendMailException
@@ -161,3 +164,78 @@ class UserCreateView(AdministratorPermissionRequiredMixin, RecentAuthenticationR
     def form_valid(self, form):
         messages.success(self.request, _('The new user has been created.'))
         return super().form_valid(form)
+
+
+# TODO: COMPAT methods: Remove after https://github.com/arteria/django-hijack/pull/178 is merged
+def login_user(request, hijacked):
+    from hijack.helpers import (
+        check_hijack_authorization, get_used_backend, no_update_last_login, login,
+        hijack_started, hijack_settings
+    )
+    hijacker = request.user
+    hijack_history = [request.user._meta.pk.value_to_string(hijacker)]
+    if request.session.get('hijack_history'):
+        hijack_history = request.session['hijack_history'] + hijack_history
+
+    check_hijack_authorization(request, hijacked)
+
+    backend = get_used_backend(request)
+    hijacked.backend = "%s.%s" % (backend.__module__, backend.__class__.__name__)
+
+    with no_update_last_login():
+        # Actually log user in
+        login(request, hijacked)
+
+    hijack_started.send(
+        sender=None, request=request,
+        hijacker=hijacker, hijacked=hijacked,
+        # send IDs for backward compatibility
+        hijacker_id=hijacker.pk, hijacked_id=hijacked.pk)
+    request.session['hijack_history'] = hijack_history
+    request.session['is_hijacked_user'] = True
+    request.session['display_hijack_warning'] = True
+    request.session.modified = True
+    return redirect_to_next(request, default_url=hijack_settings.HIJACK_LOGIN_REDIRECT_URL)
+
+
+def redirect_to_next(request, default_url):
+    redirect_to = request.GET.get('next', '')
+    if not is_safe_url(redirect_to, allowed_hosts=None):
+        redirect_to = default_url
+    return HttpResponseRedirect(resolve_url(redirect_to))
+
+
+def release_hijack(request):
+    from hijack.helpers import (
+        get_used_backend, no_update_last_login, login, hijack_ended, hijack_settings
+    )
+    hijack_history = request.session.get('hijack_history', False)
+
+    if not hijack_history:
+        raise PermissionDenied
+
+    hijacker = None
+    hijacked = None
+    if hijack_history:
+        hijacked = request.user
+        user_pk = hijack_history.pop()
+        hijacker = get_object_or_404(get_user_model(), pk=user_pk)
+        backend = get_used_backend(request)
+        hijacker.backend = "%s.%s" % (backend.__module__, backend.__class__.__name__)
+        with no_update_last_login():
+            login(request, hijacker)
+    if hijack_history:
+        request.session['hijack_history'] = hijack_history
+        request.session['is_hijacked_user'] = True
+        request.session['display_hijack_warning'] = True
+    else:
+        request.session.pop('hijack_history', None)
+        request.session.pop('is_hijacked_user', None)
+        request.session.pop('display_hijack_warning', None)
+    request.session.modified = True
+    hijack_ended.send(
+        sender=None, request=request,
+        hijacker=hijacker, hijacked=hijacked,
+        # send IDs for backward compatibility
+        hijacker_id=hijacker.pk, hijacked_id=hijacked.pk)
+    return redirect_to_next(request, default_url=hijack_settings.HIJACK_LOGOUT_REDIRECT_URL)
diff --git a/src/pretix/control/views/vouchers.py b/src/pretix/control/views/vouchers.py
index bd39a519d..59bff24a7 100644
--- a/src/pretix/control/views/vouchers.py
+++ b/src/pretix/control/views/vouchers.py
@@ -3,7 +3,6 @@ import io
 from defusedcsv import csv
 from django.conf import settings
 from django.contrib import messages
-from django.core.urlresolvers import resolve, reverse
 from django.db import transaction
 from django.db.models import Sum
 from django.http import (
@@ -11,6 +10,7 @@ from django.http import (
     JsonResponse,
 )
 from django.shortcuts import redirect
+from django.urls import resolve, reverse
 from django.utils.functional import cached_property
 from django.utils.translation import ugettext_lazy as _
 from django.views.generic import (
diff --git a/src/pretix/helpers/urls.py b/src/pretix/helpers/urls.py
index dcc2b8092..6113350b9 100644
--- a/src/pretix/helpers/urls.py
+++ b/src/pretix/helpers/urls.py
@@ -1,7 +1,7 @@
 from urllib.parse import urljoin
 
 from django.conf import settings
-from django.core.urlresolvers import reverse
+from django.urls import reverse
 
 
 def build_absolute_uri(urlname, args=None, kwargs=None):
diff --git a/src/pretix/multidomain/__init__.py b/src/pretix/multidomain/__init__.py
index 18ee01d55..4ab7464d9 100644
--- a/src/pretix/multidomain/__init__.py
+++ b/src/pretix/multidomain/__init__.py
@@ -1,5 +1,6 @@
 from django.apps import AppConfig
-from django.urls import RegexURLPattern
+from django.urls import URLPattern
+from django.urls.resolvers import RegexPattern
 
 
 class PretixMultidomainConfig(AppConfig):
@@ -10,10 +11,9 @@ class PretixMultidomainConfig(AppConfig):
 default_app_config = 'pretix.multidomain.PretixMultidomainConfig'
 
 
-def event_url(regex, view, kwargs=None, name=None, require_live=True):
+def event_url(route, view, name=None, require_live=True):
     if callable(view):
-        r = RegexURLPattern(regex, view, kwargs, name)
-        r._require_live = require_live
-        return r
-    else:
-        raise TypeError('view must be a callable.')
+        pattern = RegexPattern(route, name=name, is_endpoint=True)
+        pattern._require_live = require_live
+        return URLPattern(pattern, view, {}, name)
+    raise TypeError('view must be a callable.')
diff --git a/src/pretix/multidomain/middlewares.py b/src/pretix/multidomain/middlewares.py
index e3979cbbf..f8e9be60c 100644
--- a/src/pretix/multidomain/middlewares.py
+++ b/src/pretix/multidomain/middlewares.py
@@ -7,9 +7,9 @@ from django.contrib.sessions.middleware import (
 )
 from django.core.cache import cache
 from django.core.exceptions import DisallowedHost
-from django.core.urlresolvers import set_urlconf
 from django.http.request import split_domain_port
 from django.middleware.csrf import CsrfViewMiddleware as BaseCsrfMiddleware
+from django.urls import set_urlconf
 from django.utils.cache import patch_vary_headers
 from django.utils.deprecation import MiddlewareMixin
 from django.utils.http import cookie_date
diff --git a/src/pretix/multidomain/models.py b/src/pretix/multidomain/models.py
index 20247b642..dc8eb0bae 100644
--- a/src/pretix/multidomain/models.py
+++ b/src/pretix/multidomain/models.py
@@ -7,7 +7,7 @@ from pretix.base.models import Organizer
 
 class KnownDomain(models.Model):
     domainname = models.CharField(max_length=255, primary_key=True)
-    organizer = models.ForeignKey(Organizer, blank=True, null=True, related_name='domains')
+    organizer = models.ForeignKey(Organizer, blank=True, null=True, related_name='domains', on_delete=models.CASCADE)
 
     class Meta:
         verbose_name = _("Known domain")
diff --git a/src/pretix/multidomain/plugin_handler.py b/src/pretix/multidomain/plugin_handler.py
index 82db4e2a8..e58dc4b84 100644
--- a/src/pretix/multidomain/plugin_handler.py
+++ b/src/pretix/multidomain/plugin_handler.py
@@ -7,5 +7,5 @@ def plugin_event_urls(urllist, plugin):
             plugin_event_urls(entry.url_patterns, plugin)
         elif hasattr(entry, 'callback'):
             entry.callback = _event_view(entry.callback, require_plugin=plugin,
-                                         require_live=getattr(entry, '_require_live', True))
+                                         require_live=getattr(entry.pattern, '_require_live', True))
     return urllist
diff --git a/src/pretix/multidomain/templatetags/eventurl.py b/src/pretix/multidomain/templatetags/eventurl.py
index 47203909b..8ac978652 100644
--- a/src/pretix/multidomain/templatetags/eventurl.py
+++ b/src/pretix/multidomain/templatetags/eventurl.py
@@ -1,8 +1,8 @@
 from django import template
-from django.core.urlresolvers import NoReverseMatch
 from django.template import TemplateSyntaxError
 from django.template.base import kwarg_re
 from django.template.defaulttags import URLNode
+from django.urls import NoReverseMatch
 from django.utils.encoding import smart_text
 from django.utils.html import conditional_escape
 
diff --git a/src/pretix/multidomain/urlreverse.py b/src/pretix/multidomain/urlreverse.py
index 12be96873..c098c21d6 100644
--- a/src/pretix/multidomain/urlreverse.py
+++ b/src/pretix/multidomain/urlreverse.py
@@ -1,7 +1,7 @@
 from urllib.parse import urljoin, urlsplit
 
 from django.conf import settings
-from django.core.urlresolvers import reverse
+from django.urls import reverse
 
 from pretix.base.models import Event, Organizer
 
diff --git a/src/pretix/plugins/banktransfer/api.py b/src/pretix/plugins/banktransfer/api.py
index ac7991c4e..e3e02de52 100644
--- a/src/pretix/plugins/banktransfer/api.py
+++ b/src/pretix/plugins/banktransfer/api.py
@@ -47,7 +47,7 @@ class BankImportJobSerializer(serializers.ModelSerializer):
 
 
 class JobFilter(FilterSet):
-    event = django_filters.CharFilter(name='event', lookup_expr='slug')
+    event = django_filters.CharFilter(field_name='event', lookup_expr='slug')
 
     class Meta:
         model = BankImportJob
@@ -58,7 +58,7 @@ class BankImportJobViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
     serializer_class = BankImportJobSerializer
     queryset = BankImportJob.objects.none()
     filter_backends = (DjangoFilterBackend,)
-    filter_class = JobFilter
+    filterset_class = JobFilter
     permission = 'can_view_orders'
 
     def get_queryset(self):
diff --git a/src/pretix/plugins/banktransfer/models.py b/src/pretix/plugins/banktransfer/models.py
index ee12af0aa..ed1b239ae 100644
--- a/src/pretix/plugins/banktransfer/models.py
+++ b/src/pretix/plugins/banktransfer/models.py
@@ -16,8 +16,8 @@ class BankImportJob(models.Model):
         (STATE_COMPLETED, 'completed'),
     )
 
-    event = models.ForeignKey('pretixbase.Event', null=True)
-    organizer = models.ForeignKey('pretixbase.Organizer', null=True)
+    event = models.ForeignKey('pretixbase.Event', null=True, on_delete=models.CASCADE)
+    organizer = models.ForeignKey('pretixbase.Organizer', null=True, on_delete=models.CASCADE)
     created = models.DateTimeField(auto_now_add=True)
     state = models.CharField(max_length=32, choices=STATES, default=STATE_PENDING)
 
@@ -48,9 +48,9 @@ class BankTransaction(models.Model):
         (STATE_DISCARDED, 'manually discarded'),
     )
 
-    event = models.ForeignKey('pretixbase.Event', null=True)
-    organizer = models.ForeignKey('pretixbase.Organizer', null=True)
-    import_job = models.ForeignKey('BankImportJob', related_name='transactions')
+    event = models.ForeignKey('pretixbase.Event', null=True, on_delete=models.CASCADE)
+    organizer = models.ForeignKey('pretixbase.Organizer', null=True, on_delete=models.CASCADE)
+    import_job = models.ForeignKey('BankImportJob', related_name='transactions', on_delete=models.CASCADE)
     state = models.CharField(max_length=32, choices=STATES, default=STATE_UNCHECKED)
     message = models.TextField()
     checksum = models.CharField(max_length=190, db_index=True)
@@ -58,7 +58,7 @@ class BankTransaction(models.Model):
     reference = models.TextField(blank=True)
     amount = models.DecimalField(max_digits=10, decimal_places=2)
     date = models.CharField(max_length=50)
-    order = models.ForeignKey('pretixbase.Order', null=True, blank=True)
+    order = models.ForeignKey('pretixbase.Order', null=True, blank=True, on_delete=models.CASCADE)
     comment = models.TextField(blank=True)
 
     def calculate_checksum(self):
diff --git a/src/pretix/plugins/banktransfer/signals.py b/src/pretix/plugins/banktransfer/signals.py
index fcf994675..1eaab52cf 100644
--- a/src/pretix/plugins/banktransfer/signals.py
+++ b/src/pretix/plugins/banktransfer/signals.py
@@ -1,6 +1,6 @@
-from django.core.urlresolvers import resolve, reverse
 from django.dispatch import receiver
 from django.template.loader import get_template
+from django.urls import resolve, reverse
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.signals import register_payment_providers
diff --git a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/control_head.html b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/control_head.html
index 2c7c88127..9bcde7fa2 100644
--- a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/control_head.html
+++ b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/control_head.html
@@ -1,4 +1,4 @@
-{% load staticfiles %}
+{% load static %}
 {% load compress %}
 
 {% compress css %}
diff --git a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/job_detail.html b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/job_detail.html
index 00b86c9ab..627a64be3 100644
--- a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/job_detail.html
+++ b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/job_detail.html
@@ -1,6 +1,6 @@
 {% extends basetpl %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% block inner %}
     <h2>{% trans "Import result" %}</h2>
     {% if job.state == "running" or job.state == "pending" %}
diff --git a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/transaction_list.html b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/transaction_list.html
index 9db62d3a6..1e2d2cd15 100644
--- a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/transaction_list.html
+++ b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/transaction_list.html
@@ -1,7 +1,7 @@
 {% load i18n %}
 {% load rich_text %}
 {% load money %}
-{% load staticfiles %}
+{% load static %}
 <div class="table-responsive">
     {% csrf_token %}
     <table class="table table-condensed transaction-list" data-url="{% if request.event %}{% url "plugins:banktransfer:import.action" event=request.event.slug organizer=request.organizer.slug %}{% else %}{% url "plugins:banktransfer:import.action" organizer=request.organizer.slug %}{% endif %}">
diff --git a/src/pretix/plugins/banktransfer/views.py b/src/pretix/plugins/banktransfer/views.py
index 85a557272..aa4c7c416 100644
--- a/src/pretix/plugins/banktransfer/views.py
+++ b/src/pretix/plugins/banktransfer/views.py
@@ -4,11 +4,11 @@ import logging
 from datetime import timedelta
 
 from django.contrib import messages
-from django.core.urlresolvers import reverse
 from django.db.models import Count, Q
 from django.db.models.functions import Concat
 from django.http import JsonResponse
 from django.shortcuts import get_object_or_404, redirect, render
+from django.urls import reverse
 from django.utils.functional import cached_property
 from django.utils.timezone import now
 from django.utils.translation import ugettext as _
diff --git a/src/pretix/plugins/paypal/models.py b/src/pretix/plugins/paypal/models.py
index 0470a1a07..75085dc5a 100644
--- a/src/pretix/plugins/paypal/models.py
+++ b/src/pretix/plugins/paypal/models.py
@@ -3,5 +3,5 @@ from django.db import models
 
 class ReferencedPayPalObject(models.Model):
     reference = models.CharField(max_length=190, db_index=True, unique=True)
-    order = models.ForeignKey('pretixbase.Order')
-    payment = models.ForeignKey('pretixbase.OrderPayment', null=True, blank=True)
+    order = models.ForeignKey('pretixbase.Order', on_delete=models.CASCADE)
+    payment = models.ForeignKey('pretixbase.OrderPayment', null=True, blank=True, on_delete=models.CASCADE)
diff --git a/src/pretix/plugins/paypal/templates/pretixplugins/paypal/redirect.html b/src/pretix/plugins/paypal/templates/pretixplugins/paypal/redirect.html
index 01c9d1ae9..2b7ff2984 100644
--- a/src/pretix/plugins/paypal/templates/pretixplugins/paypal/redirect.html
+++ b/src/pretix/plugins/paypal/templates/pretixplugins/paypal/redirect.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/plugins/pretixdroid/models.py b/src/pretix/plugins/pretixdroid/models.py
index 10824f835..15239ae02 100644
--- a/src/pretix/plugins/pretixdroid/models.py
+++ b/src/pretix/plugins/pretixdroid/models.py
@@ -6,7 +6,7 @@ from django.utils.translation import ugettext_lazy as _
 
 
 class AppConfiguration(models.Model):
-    event = models.ForeignKey('pretixbase.Event')
+    event = models.ForeignKey('pretixbase.Event', on_delete=models.CASCADE)
     key = models.CharField(max_length=190, db_index=True)
     all_items = models.BooleanField(default=True, verbose_name=_('Can scan all products'))
     items = models.ManyToManyField('pretixbase.Item', blank=True, verbose_name=_('Can scan these products'))
diff --git a/src/pretix/plugins/pretixdroid/signals.py b/src/pretix/plugins/pretixdroid/signals.py
index 3a0f4db6a..7f4a8746c 100644
--- a/src/pretix/plugins/pretixdroid/signals.py
+++ b/src/pretix/plugins/pretixdroid/signals.py
@@ -1,6 +1,6 @@
 
-from django.core.urlresolvers import resolve, reverse
 from django.dispatch import receiver
+from django.urls import resolve, reverse
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.signals import logentry_display
diff --git a/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration.html b/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration.html
index f59ca2f0a..bee4b3293 100644
--- a/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration.html
+++ b/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/event/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% block title %}{% trans "Check-in device configuration" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Check-in device configuration" %}</h1>
diff --git a/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration_code.html b/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration_code.html
index 7438f9489..bbdc034b1 100644
--- a/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration_code.html
+++ b/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration_code.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/event/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% block title %}{% trans "Device configuration" %}{% endblock %}
 {% block content %}
     {% if config.app == "pretixdroid" %}
diff --git a/src/pretix/plugins/sendmail/signals.py b/src/pretix/plugins/sendmail/signals.py
index f35d799f5..6f665e499 100644
--- a/src/pretix/plugins/sendmail/signals.py
+++ b/src/pretix/plugins/sendmail/signals.py
@@ -1,5 +1,5 @@
-from django.core.urlresolvers import resolve, reverse
 from django.dispatch import receiver
+from django.urls import resolve, reverse
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.signals import logentry_display
diff --git a/src/pretix/plugins/statistics/signals.py b/src/pretix/plugins/statistics/signals.py
index a08edf1f5..384405c56 100644
--- a/src/pretix/plugins/statistics/signals.py
+++ b/src/pretix/plugins/statistics/signals.py
@@ -1,5 +1,5 @@
-from django.core.urlresolvers import resolve, reverse
 from django.dispatch import receiver
+from django.urls import resolve, reverse
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.signals import order_paid, order_placed
diff --git a/src/pretix/plugins/statistics/templates/pretixplugins/statistics/index.html b/src/pretix/plugins/statistics/templates/pretixplugins/statistics/index.html
index 0cab4bc18..ef4a57066 100644
--- a/src/pretix/plugins/statistics/templates/pretixplugins/statistics/index.html
+++ b/src/pretix/plugins/statistics/templates/pretixplugins/statistics/index.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/event/base.html" %}
 {% load i18n %}
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 {% load escapejson %}
 {% block title %}{% trans "Statistics" %}{% endblock %}
 {% block content %}
diff --git a/src/pretix/plugins/stripe/models.py b/src/pretix/plugins/stripe/models.py
index a192dda5a..9ebdc32d6 100644
--- a/src/pretix/plugins/stripe/models.py
+++ b/src/pretix/plugins/stripe/models.py
@@ -3,5 +3,5 @@ from django.db import models
 
 class ReferencedStripeObject(models.Model):
     reference = models.CharField(max_length=190, db_index=True, unique=True)
-    order = models.ForeignKey('pretixbase.Order')
-    payment = models.ForeignKey('pretixbase.OrderPayment', null=True, blank=True)
+    order = models.ForeignKey('pretixbase.Order', on_delete=models.CASCADE)
+    payment = models.ForeignKey('pretixbase.OrderPayment', null=True, blank=True, on_delete=models.CASCADE)
diff --git a/src/pretix/plugins/stripe/signals.py b/src/pretix/plugins/stripe/signals.py
index 7e16415b0..320d4580c 100644
--- a/src/pretix/plugins/stripe/signals.py
+++ b/src/pretix/plugins/stripe/signals.py
@@ -2,9 +2,9 @@ import json
 from collections import OrderedDict
 
 from django import forms
-from django.core.urlresolvers import resolve
 from django.dispatch import receiver
 from django.template.loader import get_template
+from django.urls import resolve
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.settings import settings_hierarkey
diff --git a/src/pretix/plugins/stripe/templates/pretixplugins/stripe/presale_head.html b/src/pretix/plugins/stripe/templates/pretixplugins/stripe/presale_head.html
index af4c0808c..07430fef0 100644
--- a/src/pretix/plugins/stripe/templates/pretixplugins/stripe/presale_head.html
+++ b/src/pretix/plugins/stripe/templates/pretixplugins/stripe/presale_head.html
@@ -1,4 +1,4 @@
-{% load staticfiles %}
+{% load static %}
 {% load compress %}
 {% load i18n %}
 
diff --git a/src/pretix/plugins/stripe/templates/pretixplugins/stripe/redirect.html b/src/pretix/plugins/stripe/templates/pretixplugins/stripe/redirect.html
index 01c9d1ae9..2b7ff2984 100644
--- a/src/pretix/plugins/stripe/templates/pretixplugins/stripe/redirect.html
+++ b/src/pretix/plugins/stripe/templates/pretixplugins/stripe/redirect.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/presale/forms/checkout.py b/src/pretix/presale/forms/checkout.py
index 230de222b..0d2d3b882 100644
--- a/src/pretix/presale/forms/checkout.py
+++ b/src/pretix/presale/forms/checkout.py
@@ -138,6 +138,7 @@ class AddOnsForm(forms.Form):
         if override_price:
             price = override_price
 
+        print(price, repr(price), type(price), repr(item.default_price))
         if self.price_included:
             price = TAXED_ZERO
         else:
diff --git a/src/pretix/presale/middleware.py b/src/pretix/presale/middleware.py
index 15509e897..48af18523 100644
--- a/src/pretix/presale/middleware.py
+++ b/src/pretix/presale/middleware.py
@@ -1,4 +1,4 @@
-from django.core.urlresolvers import resolve
+from django.urls import resolve
 from django.utils.deprecation import MiddlewareMixin
 
 from pretix.presale.signals import process_response
diff --git a/src/pretix/presale/templates/pretixpresale/base.html b/src/pretix/presale/templates/pretixpresale/base.html
index 149f77ff5..67c055b49 100644
--- a/src/pretix/presale/templates/pretixpresale/base.html
+++ b/src/pretix/presale/templates/pretixpresale/base.html
@@ -1,5 +1,5 @@
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% load safelink %}
 {% load statici18n %}
diff --git a/src/pretix/presale/templates/pretixpresale/event/base.html b/src/pretix/presale/templates/pretixpresale/event/base.html
index cac2b5357..0337b699b 100644
--- a/src/pretix/presale/templates/pretixpresale/event/base.html
+++ b/src/pretix/presale/templates/pretixpresale/event/base.html
@@ -1,6 +1,6 @@
 {% extends "pretixpresale/base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load thumb %}
 {% load eventurl %}
 {% load safelink %}
diff --git a/src/pretix/presale/templates/pretixpresale/index.html b/src/pretix/presale/templates/pretixpresale/index.html
index ebd713eca..c308484ae 100644
--- a/src/pretix/presale/templates/pretixpresale/index.html
+++ b/src/pretix/presale/templates/pretixpresale/index.html
@@ -1,6 +1,6 @@
 {% load i18n %}
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/presale/templates/pretixpresale/organizers/base.html b/src/pretix/presale/templates/pretixpresale/organizers/base.html
index e335d8b2f..328aebc2c 100644
--- a/src/pretix/presale/templates/pretixpresale/organizers/base.html
+++ b/src/pretix/presale/templates/pretixpresale/organizers/base.html
@@ -1,6 +1,6 @@
 {% extends "pretixpresale/base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load thumb %}
 {% load eventurl %}
 {% block thetitle %}
diff --git a/src/pretix/presale/templates/pretixpresale/waiting.html b/src/pretix/presale/templates/pretixpresale/waiting.html
index ebd785c2f..bfe0c758c 100644
--- a/src/pretix/presale/templates/pretixpresale/waiting.html
+++ b/src/pretix/presale/templates/pretixpresale/waiting.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/presale/templates/pretixpresale/widget_dummy.html b/src/pretix/presale/templates/pretixpresale/widget_dummy.html
index 6eefdc801..63ace3c19 100644
--- a/src/pretix/presale/templates/pretixpresale/widget_dummy.html
+++ b/src/pretix/presale/templates/pretixpresale/widget_dummy.html
@@ -1,5 +1,5 @@
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 {% compress css %}
     <link rel="stylesheet" type="text/x-scss" href="{% static "pretixpresale/scss/widget.scss" %}"/>
 {% endcompress %}
diff --git a/src/pretix/presale/utils.py b/src/pretix/presale/utils.py
index 77aac6102..bea37a1d3 100644
--- a/src/pretix/presale/utils.py
+++ b/src/pretix/presale/utils.py
@@ -4,9 +4,9 @@ from urllib.parse import urljoin
 
 from django.conf import settings
 from django.core.exceptions import PermissionDenied
-from django.core.urlresolvers import resolve
 from django.http import Http404
 from django.shortcuts import redirect
+from django.urls import resolve
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.middleware import LocaleMiddleware
diff --git a/src/pretix/presale/views/cart.py b/src/pretix/presale/views/cart.py
index 19b4f4ccb..ccd92cd53 100644
--- a/src/pretix/presale/views/cart.py
+++ b/src/pretix/presale/views/cart.py
@@ -36,7 +36,7 @@ from pretix.presale.views.robots import NoSearchIndexViewMixin
 class CartActionMixin:
 
     def get_next_url(self):
-        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next")):
+        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next"), allowed_hosts=None):
             u = self.request.GET.get('next')
         else:
             kwargs = {}
diff --git a/src/pretix/presale/views/locale.py b/src/pretix/presale/views/locale.py
index 4914e8776..e37c24599 100644
--- a/src/pretix/presale/views/locale.py
+++ b/src/pretix/presale/views/locale.py
@@ -12,7 +12,7 @@ class LocaleSet(NoSearchIndexViewMixin, View):
 
     def get(self, request, *args, **kwargs):
         url = request.GET.get('next', request.META.get('HTTP_REFERER', '/'))
-        url = url if is_safe_url(url, host=request.get_host()) else '/'
+        url = url if is_safe_url(url, allowed_hosts=[request.get_host()]) else '/'
         resp = HttpResponseRedirect(url)
 
         locale = request.GET.get('locale')
diff --git a/src/pretix/presale/views/widget.py b/src/pretix/presale/views/widget.py
index f84ad5575..69377cb56 100644
--- a/src/pretix/presale/views/widget.py
+++ b/src/pretix/presale/views/widget.py
@@ -14,11 +14,12 @@ from django.template.loader import get_template
 from django.utils.formats import date_format
 from django.utils.timezone import now
 from django.utils.translation import gettext
+from django.utils.translation.trans_real import DjangoTranslation
 from django.views import View
 from django.views.decorators.cache import cache_page
 from django.views.decorators.http import condition
 from django.views.i18n import (
-    get_formats, get_javascript_catalog, js_catalog_template,
+    JavaScriptCatalog, get_formats, js_catalog_template,
 )
 from lxml import etree
 
@@ -73,7 +74,10 @@ def generate_widget_js(lang):
         code.append('var module = {}, exports = {};\n')
         code.append('var lang = "%s";\n' % lang)
 
-        catalog, plural = get_javascript_catalog(lang, 'djangojs', ['pretix'])
+        c = JavaScriptCatalog()
+        c.translation = DjangoTranslation(lang, domain='djangojs')
+        catalog, plural = c.get_catalog(), c.get_plural()
+
         catalog = dict((k, v) for k, v in catalog.items() if k.startswith('widget\u0004'))
         template = Engine().from_string(js_catalog_template)
         context = Context({
diff --git a/src/pretix/settings.py b/src/pretix/settings.py
index 3800460fd..66da306a9 100644
--- a/src/pretix/settings.py
+++ b/src/pretix/settings.py
@@ -272,6 +272,7 @@ REST_FRAMEWORK = {
     'DEFAULT_PERMISSION_CLASSES': [
         'pretix.api.auth.permission.EventPermission',
     ],
+    'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.PageNumberPagination',
     'DEFAULT_VERSIONING_CLASS': 'rest_framework.versioning.NamespaceVersioning',
     'PAGE_SIZE': 50,
     'DEFAULT_AUTHENTICATION_CLASSES': (
@@ -300,7 +301,6 @@ MIDDLEWARE = [
     'pretix.multidomain.middlewares.SessionMiddleware',
     'pretix.multidomain.middlewares.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
-    'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'pretix.control.middleware.PermissionMiddleware',
diff --git a/src/pretix/static/jsi18n/en/djangojs.js b/src/pretix/static/jsi18n/en/djangojs.js
index 3a315fda0..8b7336b13 100644
--- a/src/pretix/static/jsi18n/en/djangojs.js
+++ b/src/pretix/static/jsi18n/en/djangojs.js
@@ -84,9 +84,9 @@
       "%m/%d/%y"
     ],
     "DECIMAL_SEPARATOR": ".",
-    "FIRST_DAY_OF_WEEK": "0",
+    "FIRST_DAY_OF_WEEK": 0,
     "MONTH_DAY_FORMAT": "F j",
-    "NUMBER_GROUPING": "3",
+    "NUMBER_GROUPING": 3,
     "SHORT_DATETIME_FORMAT": "Y-m-d H:i",
     "SHORT_DATE_FORMAT": "Y-m-d",
     "THOUSAND_SEPARATOR": ",",
diff --git a/src/pretix/urls.py b/src/pretix/urls.py
index e54741604..2dbabd01a 100644
--- a/src/pretix/urls.py
+++ b/src/pretix/urls.py
@@ -17,7 +17,7 @@ base_patterns = [
     url(r'^metrics$', metrics.serve_metrics,
         name='metrics'),
     url(r'^csp_report/$', csp.csp_report, name='csp.report'),
-    url(r'^api/v1/', include('pretix.api.urls', namespace='api-v1')),
+    url(r'^api/v1/', include(('pretix.api.urls', 'pretixapi'), namespace='api-v1')),
     url(r'^api/$', RedirectView.as_view(url='/api/v1/'), name='redirect-api-version')
 ]
 
diff --git a/src/requirements/dev.txt b/src/requirements/dev.txt
index 09aafe550..ac01b422a 100644
--- a/src/requirements/dev.txt
+++ b/src/requirements/dev.txt
@@ -1,4 +1,4 @@
-django-debug-toolbar==1.8
+django-debug-toolbar==1.9.1
 sqlparse==0.2.1  # pinned due to difficulties with django-debug-toolbar
 # Testing requirements
 pep8==1.5.7  # exact requirement by flake8 2.4.0
@@ -10,8 +10,8 @@ coverage
 pytest==3.6.*
 pytest-django
 isort
-pytest-mock==1.4.*
 pytest-rerunfailures==4.*
+pytest-mock==1.6.*
 pytest-cache
 pytest-sugar
 responses
diff --git a/src/requirements/production.txt b/src/requirements/production.txt
index 3a731fdfa..3fd0869ae 100644
--- a/src/requirements/production.txt
+++ b/src/requirements/production.txt
@@ -1,29 +1,29 @@
 # Functional requirements
-Django==1.11.*
-djangorestframework==3.6.*
+Django>=2.1,<2.2
+djangorestframework==3.8.*
 python-dateutil
 pytz
-django-bootstrap3==8.2.*
+django-bootstrap3==10.0.*
 django-formset-js-improved==0.5.0.2
-django-compressor==2.1.1
+django-compressor==2.2.*
 django-hierarkey==1.0.*,>=1.0.3
-django-filter==1.0.*
-reportlab==3.4.*
+django-filter==2.0.*
+reportlab==3.5.*
 PyPDF2==1.26.*
 Pillow
 django-libsass
 libsass
-django-otp==0.3.*
+django-otp==0.4.*
 python-u2flib-server==4.*
-django-formtools==2.0
+django-formtools==2.1
 celery>=4.1.1,<4.2.0
 kombu==4.2.*
-django-statici18n==1.3.*
+django-statici18n==1.8.*
 inlinestyler==0.2.*
 BeautifulSoup4
 slimit
 lxml
-static3==0.6.1
+static3==0.7.*
 dj-static
 csscompressor
 django-markup
@@ -31,13 +31,13 @@ markdown
 bleach==2.*
 raven
 babel
-django-i18nfield>=1.2.1
+django-i18nfield>=1.4.0
 django-hijack==2.1.*
-django-oauth-toolkit==1.1.*
+django-oauth-toolkit==1.2.*
 # Stripe
 stripe==2.0.*
 # PayPal
-paypalrestsdk==1.12.*
+paypalrestsdk==1.13.*
 pycparser==2.13  # https://github.com/eliben/pycparser/issues/147
 # Banktransfer
 chardet<3.1.0,>=3.0.2
diff --git a/src/requirements/py34.txt b/src/requirements/py34.txt
deleted file mode 100644
index c997f364b..000000000
--- a/src/requirements/py34.txt
+++ /dev/null
@@ -1 +0,0 @@
-typing
diff --git a/src/setup.py b/src/setup.py
index b4e85e739..c8f8b7c87 100644
--- a/src/setup.py
+++ b/src/setup.py
@@ -1,4 +1,5 @@
 import os
+import sys
 from codecs import open
 from distutils.command.build import build
 from os import path
@@ -7,6 +8,27 @@ from setuptools import find_packages, setup
 
 from pretix import __version__
 
+CURRENT_PYTHON = sys.version_info[:2]
+REQUIRED_PYTHON = (3, 5)
+if CURRENT_PYTHON < REQUIRED_PYTHON:
+    sys.stderr.write("""
+==========================
+Unsupported Python version
+==========================
+This version of pretix requires Python {}.{}, but you're trying to
+install it on Python {}.{}.
+This may be because you are using a version of pip that doesn't
+understand the python_requires classifier. Make sure you
+have pip >= 9.0 and setuptools >= 24.2, then try again:
+    $ python -m pip install --upgrade pip setuptools
+    $ python -m pip install pretix
+This will install the latest version of pretix which works on your
+version of Python. If you can't upgrade your pip (or Python), request
+an older version of pretix:
+    $ python -m pip install "pretix<2"
+""".format(*(REQUIRED_PYTHON + CURRENT_PYTHON)))
+    sys.exit(1)
+
 here = path.abspath(path.dirname(__file__))
 
 # Get the long description from the relevant file
@@ -43,6 +65,7 @@ cmdclass = {
 setup(
     name='pretix',
     version=__version__,
+    python_requires='>={}.{}'.format(*REQUIRED_PYTHON),
     description='Reinventing presales, one ticket at a time',
     long_description=long_description,
     url='https://pretix.eu',
@@ -56,39 +79,39 @@ setup(
         'Topic :: Internet :: WWW/HTTP :: Dynamic Content',
         'Environment :: Web Environment',
         'License :: OSI Approved :: Apache Software License',
-        'Programming Language :: Python :: 3.4',
         'Programming Language :: Python :: 3.5',
         'Programming Language :: Python :: 3.6',
-        'Framework :: Django :: 1.11'
+        'Programming Language :: Python :: 3.7',
+        'Framework :: Django :: 2.1'
     ],
 
     keywords='tickets web shop ecommerce',
     install_requires=[
-        'Django==1.11.*',
-        'djangorestframework==3.6.*',
+        'Django>=2.1,<2.2',
+        'djangorestframework==3.8.*',
         'python-dateutil==2.4.*',
         'pytz',
-        'django-bootstrap3==8.2.*',
+        'django-bootstrap3==10.0.*',
         'django-formset-js-improved==0.5.0.2',
-        'django-compressor==2.1',
+        'django-compressor==2.2.*',
         'django-hierarkey==1.0.*,>=1.0.2',
-        'django-filter==1.0.*',
-        'reportlab==3.4.*',
+        'django-filter==2.0.*',
+        'reportlab==3.5.*',
         'Pillow',
         'PyPDF2==1.26.*',
         'django-libsass',
         'libsass',
-        'django-otp==0.3.*',
+        'django-otp==0.4.*',
         'python-u2flib-server==4.*',
-        'django-formtools==2.0',
+        'django-formtools==2.1',
         'celery>=4.1.1,<4.2.0',
         'kombu==4.2.*',
-        'django-statici18n==1.3.*',
+        'django-statici18n==1.8.*',
         'inlinestyler==0.2.*',
         'BeautifulSoup4',
         'slimit',
         'lxml',
-        'static3==0.6.1',
+        'static3==0.7.*',
         'dj-static',
         'csscompressor',
         'django-markup',
@@ -96,14 +119,14 @@ setup(
         'bleach==2.*',
         'raven',
         'babel',
-        'paypalrestsdk==1.12.*',
+        'paypalrestsdk==1.13.*',
         'pycparser==2.13',
         'django-redis==4.7.*',
         'redis==2.10.5',
         'stripe==2.0.*',
         'chardet<3.1.0,>=3.0.2',
-        'mt-940==4.7',
-        'django-i18nfield>=1.2.1',
+        'mt-940==3.2',
+        'django-i18nfield>=1.4.0',
         'vobject==0.9.*',
         'pycountry',
         'django-countries',
@@ -111,12 +134,12 @@ setup(
         'defusedcsv',
         'vat_moss==0.11.0',
         'django-hijack==2.1.*',
-        'django-oauth-toolkit==1.1.*',
+        'django-oauth-toolkit==1.2.*',
         'idna==2.6',  # required by current requests
     ],
     extras_require={
         'dev': [
-            'django-debug-toolbar==1.7',
+            'django-debug-toolbar==1.9.1',
             'sqlparse==0.2.1',
             'pep8==1.5.7',
             'pyflakes==1.1.0',
@@ -127,7 +150,7 @@ setup(
             'pytest==3.6.*',
             'pytest-django',
             'isort',
-            'pytest-mock',
+            'pytest-mock==1.6.*',
             'pytest-rerunfailures',
             'pytest-warnings',
             'responses'
diff --git a/src/tests/api/test_auth.py b/src/tests/api/test_auth.py
index b6c604646..19e796250 100644
--- a/src/tests/api/test_auth.py
+++ b/src/tests/api/test_auth.py
@@ -13,6 +13,7 @@ def test_no_auth(client):
 def test_session_auth_no_teams(client, user):
     client.login(email=user.email, password='dummy')
     resp = client.get('/api/v1/organizers/')
+    print(resp.data)
     assert resp.status_code == 200
     assert len(resp.data['results']) == 0
 
@@ -20,7 +21,7 @@ def test_session_auth_no_teams(client, user):
 @pytest.mark.django_db
 def test_session_auth_with_teams(client, user, team):
     team.members.add(user)
-    Organizer.objects.create(name='Other dummy', slug='dummy')
+    Organizer.objects.create(name='Other dummy', slug='dummy2')
     client.login(email=user.email, password='dummy')
     resp = client.get('/api/v1/organizers/')
     assert resp.status_code == 200
@@ -36,7 +37,7 @@ def test_token_invalid(client):
 
 @pytest.mark.django_db
 def test_token_auth_valid(client, team):
-    Organizer.objects.create(name='Other dummy', slug='dummy')
+    Organizer.objects.create(name='Other dummy', slug='dummy2')
     t = team.tokens.create(name='Foo')
     client.credentials(HTTP_AUTHORIZATION='Token ' + t.token)
     resp = client.get('/api/v1/organizers/')
@@ -46,7 +47,7 @@ def test_token_auth_valid(client, team):
 
 @pytest.mark.django_db
 def test_token_auth_inactive(client, team):
-    Organizer.objects.create(name='Other dummy', slug='dummy')
+    Organizer.objects.create(name='Other dummy', slug='dummy2')
     t = team.tokens.create(name='Foo', active=False)
     client.credentials(HTTP_AUTHORIZATION='Token ' + t.token)
     resp = client.get('/api/v1/organizers/')
diff --git a/src/tests/api/test_checkin.py b/src/tests/api/test_checkin.py
index 33f75fd6a..d3fcb4c14 100644
--- a/src/tests/api/test_checkin.py
+++ b/src/tests/api/test_checkin.py
@@ -151,8 +151,9 @@ def test_list_list(token_client, organizer, event, clist, item, subevent):
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/checkinlists/?subevent={}'.format(organizer.slug, event.slug, subevent.pk))
     assert [res] == resp.data['results']
+    se2 = event.subevents.create(name="Foobar", date_from=datetime.datetime(2017, 12, 27, 10, 0, 0, tzinfo=UTC))
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/checkinlists/?subevent={}'.format(organizer.slug, event.slug, subevent.pk + 1))
+        '/api/v1/organizers/{}/events/{}/checkinlists/?subevent={}'.format(organizer.slug, event.slug, se2.pk))
     assert [] == resp.data['results']
 
 
diff --git a/src/tests/api/test_items.py b/src/tests/api/test_items.py
index fe3d22965..4646dd81e 100644
--- a/src/tests/api/test_items.py
+++ b/src/tests/api/test_items.py
@@ -238,6 +238,7 @@ TEST_ITEM_RES = {
 
 @pytest.mark.django_db
 def test_item_list(token_client, organizer, event, team, item):
+    cat = event.categories.create(name="foo")
     res = dict(TEST_ITEM_RES)
     res["id"] = item.pk
     resp = token_client.get('/api/v1/organizers/{}/events/{}/items/'.format(organizer.slug, event.slug))
@@ -252,7 +253,8 @@ def test_item_list(token_client, organizer, event, team, item):
     assert resp.status_code == 200
     assert [] == resp.data['results']
 
-    resp = token_client.get('/api/v1/organizers/{}/events/{}/items/?category=1'.format(organizer.slug, event.slug))
+    resp = token_client.get('/api/v1/organizers/{}/events/{}/items/?category={}'.format(organizer.slug, event.slug,
+                                                                                        cat.pk))
     assert resp.status_code == 200
     assert [] == resp.data['results']
 
@@ -1074,8 +1076,9 @@ def test_quota_list(token_client, organizer, event, quota, item, subevent):
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/quotas/?subevent={}'.format(organizer.slug, event.slug, subevent.pk))
     assert [res] == resp.data['results']
+    se2 = event.subevents.create(name="Foobar", date_from=datetime(2017, 12, 27, 10, 0, 0, tzinfo=UTC))
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/quotas/?subevent={}'.format(organizer.slug, event.slug, subevent.pk + 1))
+        '/api/v1/organizers/{}/events/{}/quotas/?subevent={}'.format(organizer.slug, event.slug, se2.pk))
     assert [] == resp.data['results']
 
 
diff --git a/src/tests/api/test_orders.py b/src/tests/api/test_orders.py
index dbaa63100..3da357759 100644
--- a/src/tests/api/test_orders.py
+++ b/src/tests/api/test_orders.py
@@ -535,6 +535,7 @@ def test_orderposition_list(token_client, organizer, event, order, item, subeven
     i2.pk = None
     i2.save()
     var = item.variations.create(value="Children")
+    var2 = item.variations.create(value="Children")
     res = dict(TEST_ORDERPOSITION_RES)
     op = order.positions.first()
     op.variation = var
@@ -564,14 +565,14 @@ def test_orderposition_list(token_client, organizer, event, order, item, subeven
         ))
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/orderpositions/?item={}'.format(organizer.slug, event.slug, item.pk + 1))
+        '/api/v1/organizers/{}/events/{}/orderpositions/?item={}'.format(organizer.slug, event.slug, i2.pk))
     assert [] == resp.data['results']
 
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/orderpositions/?variation={}'.format(organizer.slug, event.slug, var.pk))
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/orderpositions/?variation={}'.format(organizer.slug, event.slug, var.pk + 1))
+        '/api/v1/organizers/{}/events/{}/orderpositions/?variation={}'.format(organizer.slug, event.slug, var2.pk))
     assert [] == resp.data['results']
 
     resp = token_client.get(
diff --git a/src/tests/api/test_vouchers.py b/src/tests/api/test_vouchers.py
index be657a40a..e97de6501 100644
--- a/src/tests/api/test_vouchers.py
+++ b/src/tests/api/test_vouchers.py
@@ -1,3 +1,4 @@
+import copy
 import datetime
 from decimal import Decimal
 
@@ -51,6 +52,13 @@ def test_voucher_list(token_client, organizer, event, voucher, item, quota, sube
     res['item'] = item.pk
     res['id'] = voucher.pk
     res['code'] = voucher.code
+    q2 = copy.copy(quota)
+    q2.pk = None
+    q2.save()
+    i2 = copy.copy(item)
+    i2.pk = None
+    i2.save()
+    var2 = i2.variations.create(value="foo")
 
     resp = token_client.get('/api/v1/organizers/{}/events/{}/vouchers/'.format(organizer.slug, event.slug))
     assert resp.status_code == 200
@@ -124,7 +132,7 @@ def test_voucher_list(token_client, organizer, event, voucher, item, quota, sube
     )
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/vouchers/?item={}'.format(organizer.slug, event.slug, item.pk + 1)
+        '/api/v1/organizers/{}/events/{}/vouchers/?item={}'.format(organizer.slug, event.slug, i2.pk)
     )
     assert [] == resp.data['results']
 
@@ -137,7 +145,7 @@ def test_voucher_list(token_client, organizer, event, voucher, item, quota, sube
     )
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/vouchers/?variation={}'.format(organizer.slug, event.slug, var.pk + 1)
+        '/api/v1/organizers/{}/events/{}/vouchers/?variation={}'.format(organizer.slug, event.slug, var2.pk)
     )
     assert [] == resp.data['results']
 
@@ -153,7 +161,7 @@ def test_voucher_list(token_client, organizer, event, voucher, item, quota, sube
     )
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/vouchers/?quota={}'.format(organizer.slug, event.slug, quota.pk + 1)
+        '/api/v1/organizers/{}/events/{}/vouchers/?quota={}'.format(organizer.slug, event.slug, q2.pk)
     )
     assert [] == resp.data['results']
 
@@ -200,9 +208,10 @@ def test_voucher_list(token_client, organizer, event, voucher, item, quota, sube
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/vouchers/?subevent={}'.format(organizer.slug, event.slug, subevent.pk))
     assert [res] == resp.data['results']
+    se2 = event.subevents.create(name="Foobar", date_from=datetime.datetime(2017, 12, 27, 10, 0, 0, tzinfo=UTC))
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/vouchers/?subevent={}'.format(organizer.slug, event.slug,
-                                                                       subevent.pk + 1))
+                                                                       se2.pk))
     assert [] == resp.data['results']
 
 
diff --git a/src/tests/api/test_waitinglist.py b/src/tests/api/test_waitinglist.py
index 89b074ee0..f51bd8705 100644
--- a/src/tests/api/test_waitinglist.py
+++ b/src/tests/api/test_waitinglist.py
@@ -1,3 +1,4 @@
+import copy
 import datetime
 from unittest import mock
 
@@ -43,9 +44,13 @@ TEST_WLE_RES = {
 @pytest.mark.django_db
 def test_wle_list(token_client, organizer, event, wle, item, subevent):
     var = item.variations.create(value="Children")
+    var2 = item.variations.create(value="Children")
     res = dict(TEST_WLE_RES)
     wle.variation = var
     wle.save()
+    i2 = copy.copy(item)
+    i2.pk = None
+    i2.save()
     res["id"] = wle.pk
     res["item"] = item.pk
     res["variation"] = var.pk
@@ -58,14 +63,14 @@ def test_wle_list(token_client, organizer, event, wle, item, subevent):
         '/api/v1/organizers/{}/events/{}/waitinglistentries/?item={}'.format(organizer.slug, event.slug, item.pk))
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/waitinglistentries/?item={}'.format(organizer.slug, event.slug, item.pk + 1))
+        '/api/v1/organizers/{}/events/{}/waitinglistentries/?item={}'.format(organizer.slug, event.slug, i2.pk))
     assert [] == resp.data['results']
 
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/waitinglistentries/?variation={}'.format(organizer.slug, event.slug, var.pk))
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/waitinglistentries/?variation={}'.format(organizer.slug, event.slug, var.pk + 1))
+        '/api/v1/organizers/{}/events/{}/waitinglistentries/?variation={}'.format(organizer.slug, event.slug, var2.pk))
     assert [] == resp.data['results']
 
     resp = token_client.get(
@@ -106,9 +111,10 @@ def test_wle_list(token_client, organizer, event, wle, item, subevent):
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/waitinglistentries/?subevent={}'.format(organizer.slug, event.slug, subevent.pk))
     assert [res] == resp.data['results']
+    se2 = event.subevents.create(name="Foobar", date_from=datetime.datetime(2017, 12, 27, 10, 0, 0, tzinfo=UTC))
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/waitinglistentries/?subevent={}'.format(organizer.slug, event.slug,
-                                                                                 subevent.pk + 1))
+                                                                                 se2.pk))
     assert [] == resp.data['results']
 
 
diff --git a/src/tests/base/test_models.py b/src/tests/base/test_models.py
index 970fdbc12..56bc5cb53 100644
--- a/src/tests/base/test_models.py
+++ b/src/tests/base/test_models.py
@@ -1144,7 +1144,7 @@ class EventTest(TestCase):
         cl1.limit_products.add(i1)
 
         event2 = Event.objects.create(
-            organizer=self.organizer, name='Download', slug='ab1234',
+            organizer=self.organizer, name='Download', slug='ab54321',
             date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc)
         )
         event2.copy_data_from(event1)
diff --git a/src/tests/base/test_permissions.py b/src/tests/base/test_permissions.py
index c9d1e1b27..9ab39cace 100644
--- a/src/tests/base/test_permissions.py
+++ b/src/tests/base/test_permissions.py
@@ -147,7 +147,7 @@ def test_event_permissions_multiple_teams(event, user):
     team2 = Team.objects.create(organizer=event.organizer, can_change_vouchers=True)
     team3 = Team.objects.create(organizer=event.organizer, can_change_event_settings=True)
     event2 = Event.objects.create(
-        organizer=event.organizer, name='Dummy', slug='dummy',
+        organizer=event.organizer, name='Dummy', slug='dummy2',
         date_from=now()
     )
     team1.members.add(user)
diff --git a/src/tests/control/test_events.py b/src/tests/control/test_events.py
index d5aaed83e..3ffe0d828 100644
--- a/src/tests/control/test_events.py
+++ b/src/tests/control/test_events.py
@@ -417,7 +417,7 @@ class EventsTest(SoupTest):
             'foundation-organizer': self.orga2.pk,
             'foundation-locales': ('en', 'de')
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
     def test_create_invalid_default_language(self):
         doc = self.post_doc('/control/events/add', {
@@ -442,7 +442,7 @@ class EventsTest(SoupTest):
             'basics-presale_start': '2016-11-01 10:00:00',
             'basics-presale_end': '2016-11-30 18:00:00',
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
     def test_create_duplicate_slug(self):
         doc = self.post_doc('/control/events/add', {
@@ -471,7 +471,7 @@ class EventsTest(SoupTest):
             'basics-presale_end_0': '2016-11-30',
             'basics-presale_end_1': '18:00:00',
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
     def test_create_event_success(self):
         doc = self.get_doc('/control/events/add')
@@ -642,7 +642,7 @@ class EventsTest(SoupTest):
             'basics-presale_end_0': '2016-11-30',
             'basics-presale_end_1': '18:00:00',
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
     def test_create_event_currency_symbol(self):
         doc = self.post_doc('/control/events/add', {
@@ -669,7 +669,7 @@ class EventsTest(SoupTest):
             'basics-presale_end_0': '2016-11-30',
             'basics-presale_end_1': '18:00:00',
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
     def test_create_event_non_iso_currency(self):
         doc = self.post_doc('/control/events/add', {
@@ -696,7 +696,7 @@ class EventsTest(SoupTest):
             'basics-presale_end_0': '2016-11-30',
             'basics-presale_end_1': '18:00:00',
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
 
 class SubEventsTest(SoupTest):
diff --git a/src/tests/control/test_vouchers.py b/src/tests/control/test_vouchers.py
index fa22cca00..d9cf9f524 100644
--- a/src/tests/control/test_vouchers.py
+++ b/src/tests/control/test_vouchers.py
@@ -42,7 +42,7 @@ class VoucherFormTest(SoupTest):
         form_data.update(data)
         doc = self.post_doc('/control/event/%s/%s/vouchers/add' % (self.orga.slug, self.event.slug), form_data)
         if expected_failure:
-            assert doc.select(".alert-danger")
+            assert doc.select(".alert-danger, .has-error")
             assert count_before == self.event.vouchers.count()
         else:
             assert doc.select(".alert-success")
diff --git a/src/tests/helpers/test_urls.py b/src/tests/helpers/test_urls.py
index 6894a7e33..c00d842f2 100644
--- a/src/tests/helpers/test_urls.py
+++ b/src/tests/helpers/test_urls.py
@@ -1,5 +1,5 @@
+from django import urls
 from django.conf import settings
-from django.core import urlresolvers
 
 from pretix.helpers.urls import build_absolute_uri
 
@@ -11,7 +11,7 @@ def test_site_url_domain():
 
 def test_site_url_subpath():
     settings.SITE_URL = 'https://example.com/presale'
-    old_prefix = urlresolvers.get_script_prefix()
-    urlresolvers.set_script_prefix('/presale/')
+    old_prefix = urls.get_script_prefix()
+    urls.set_script_prefix('/presale/')
     assert build_absolute_uri('control:auth.login') == 'https://example.com/presale/control/login'
-    urlresolvers.set_script_prefix(old_prefix)
+    urls.set_script_prefix(old_prefix)
diff --git a/src/tests/multidomain/test_plugin_handler.py b/src/tests/multidomain/test_plugin_handler.py
new file mode 100644
index 000000000..68a893f65
--- /dev/null
+++ b/src/tests/multidomain/test_plugin_handler.py
@@ -0,0 +1,47 @@
+import pytest
+from django.conf import settings
+from django.utils.timezone import now
+
+from pretix.base.models import Event, Organizer
+
+
+@pytest.fixture
+def event():
+    o = Organizer.objects.create(name='MRMCD', slug='mrmcd')
+    event = Event.objects.create(
+        organizer=o, name='MRMCD2015', slug='2015',
+        date_from=now(),
+    )
+    settings.SITE_URL = 'http://example.com'
+    return event
+
+
+@pytest.mark.django_db
+def test_require_plugin(event, client):
+    event.plugins = 'pretix.plugins.paypal'
+    event.live = True
+    event.save()
+    r = client.get('/mrmcd/2015/paypal/abort/', follow=False)
+    assert r.status_code == 302
+    event.plugins = ''
+    event.save()
+    r = client.get('/mrmcd/2015/paypal/abort/', follow=False)
+    assert r.status_code == 404
+
+
+@pytest.mark.django_db
+def test_require_live(event, client):
+    event.plugins = 'pretix.plugins.paypal'
+    event.live = True
+    event.save()
+    r = client.get('/mrmcd/2015/paypal/abort/', follow=False)
+    assert r.status_code == 302
+    r = client.get('/mrmcd/2015/paypal/webhook/', follow=False)
+    assert r.status_code == 405
+
+    event.live = False
+    event.save()
+    r = client.get('/mrmcd/2015/paypal/abort/', follow=False)
+    assert r.status_code == 403
+    r = client.get('/mrmcd/2015/paypal/webhook/', follow=False)
+    assert r.status_code == 405
diff --git a/src/tests/multidomain/test_templatetag.py b/src/tests/multidomain/test_templatetag.py
index da06d7b1f..4bd4b028c 100644
--- a/src/tests/multidomain/test_templatetag.py
+++ b/src/tests/multidomain/test_templatetag.py
@@ -1,7 +1,7 @@
 import pytest
 from django.conf import settings
-from django.core.urlresolvers import NoReverseMatch
 from django.template import Context, Template, TemplateSyntaxError
+from django.urls import NoReverseMatch
 from django.utils.timezone import now
 
 from pretix.base.models import Event, Organizer
diff --git a/src/tests/presale/test_checkout.py b/src/tests/presale/test_checkout.py
index 636de9702..8d7975d27 100644
--- a/src/tests/presale/test_checkout.py
+++ b/src/tests/presale/test_checkout.py
@@ -49,9 +49,9 @@ class CheckoutTestCase(TestCase):
         self.workshopcat = ItemCategory.objects.create(name="Workshops", is_addon=True, event=self.event)
         self.workshopquota = Quota.objects.create(event=self.event, name='Workshop 1', size=5)
         self.workshop1 = Item.objects.create(event=self.event, name='Workshop 1',
-                                             category=self.workshopcat, default_price=12)
+                                             category=self.workshopcat, default_price=Decimal('12.00'))
         self.workshop2 = Item.objects.create(event=self.event, name='Workshop 2',
-                                             category=self.workshopcat, default_price=12)
+                                             category=self.workshopcat, default_price=Decimal('12.00'))
         self.workshop2a = ItemVariation.objects.create(item=self.workshop2, value='A')
         self.workshop2b = ItemVariation.objects.create(item=self.workshop2, value='B')
         self.workshopquota.items.add(self.workshop1)