diff --git a/.travis.sh b/.travis.sh
index 11a090a557..15691b5395 100755
--- a/.travis.sh
+++ b/.travis.sh
@@ -15,13 +15,13 @@ if [ "$PRETIX_CONFIG_FILE" == "tests/travis_postgres.cfg" ]; then
 fi
 
 if [ "$1" == "style" ]; then
-	XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements.txt -r src/requirements/dev.txt -r src/requirements/py34.txt
+	XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements.txt -r src/requirements/dev.txt
 	cd src
     flake8 .
     isort -c -rc -df .
 fi
 if [ "$1" == "doctests" ]; then
-	XDG_CACHE_HOME=/cache pip3 install -Ur doc/requirements.txt -r src/requirements/py34.txt
+	XDG_CACHE_HOME=/cache pip3 install -Ur doc/requirements.txt
 	cd doc
 	make doctest
 fi
@@ -39,21 +39,21 @@ if [ "$1" == "translation-spelling" ]; then
 	potypo
 fi
 if [ "$1" == "tests" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt -r src/requirements/py34.txt pytest-xdist
+	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt pytest-xdist
 	cd src
 	python manage.py check
 	make all compress
 	py.test --reruns 5 -n 2 tests
 fi
 if [ "$1" == "tests-cov" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt -r src/requirements/py34.txt
+	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt
 	cd src
 	python manage.py check
 	make all compress
 	coverage run -m py.test --reruns 5 tests && codecov
 fi
 if [ "$1" == "plugins" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt -r src/requirements/py34.txt
+	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt
 	cd src
 	python setup.py develop
 	make all compress
diff --git a/.travis.yml b/.travis.yml
index f68b87204b..e12f219453 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -18,20 +18,10 @@ matrix:
       env: JOB=tests-cov PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
     - python: 3.6
       env: JOB=style
-    - python: 3.4
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg
     - python: 3.5
       env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg
-    - python: 3.4
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_mysql.cfg
-    - python: 3.5
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_mysql.cfg
     - python: 3.6
       env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_mysql.cfg
-    - python: 3.4
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
-    - python: 3.5
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
     - python: 3.6
       env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
     - python: 3.6
diff --git a/doc/admin/installation/manual_smallscale.rst b/doc/admin/installation/manual_smallscale.rst
index d301ea9995..816ba0fa08 100644
--- a/doc/admin/installation/manual_smallscale.rst
+++ b/doc/admin/installation/manual_smallscale.rst
@@ -121,8 +121,7 @@ command if you're running PostgreSQL::
 
     (venv)$ pip3 install "pretix[mysql]" gunicorn
 
-If you are running Python 3.4, you also need to ``pip3 install typing``. This is not required on 3.5 or newer.
-You can find out your Python version using ``python -V``.
+Note that you need Python 3.5 or newer. You can find out your Python version using ``python -V``.
 
 We also need to create a data directory::
 
diff --git a/doc/development/api/customview.rst b/doc/development/api/customview.rst
index 710b804b2b..fbf1f6b90f 100644
--- a/doc/development/api/customview.rst
+++ b/doc/development/api/customview.rst
@@ -64,7 +64,7 @@ Similarly, there is ``organizer_permission_required`` and ``OrganizerPermissionR
 event-related views, there is also a signal that allows you to add the view to the event navigation like this::
 
 
-    from django.core.urlresolvers import resolve, reverse
+    from django.urls import resolve, reverse
     from django.dispatch import receiver
     from django.utils.translation import ugettext_lazy as _
     from pretix.control.signals import nav_event
diff --git a/doc/development/setup.rst b/doc/development/setup.rst
index 51bc36760c..028a10c1f4 100644
--- a/doc/development/setup.rst
+++ b/doc/development/setup.rst
@@ -18,7 +18,7 @@ External Dependencies
 ---------------------
 Your should install the following on your system:
 
-* Python 3.4 or newer
+* Python 3.5 or newer
 * ``pip`` for Python 3 (Debian package: ``python3-pip``)
 * ``python-dev`` for Python 3 (Debian package: ``python3-dev``)
 * ``libffi`` (Debian package: ``libffi-dev``)
@@ -54,10 +54,6 @@ The first thing you need are all the main application's dependencies::
     cd src/
     pip3 install -r requirements.txt -r requirements/dev.txt
 
-If you are working with Python 3.4, you will also need (you can skip this for Python 3.5+)::
-
-    pip3 install -r requirements/py34.txt
-
 Next, you need to copy the SCSS files from the source folder to the STATIC_ROOT directory::
 
     python manage.py collectstatic --noinput
diff --git a/src/pretix/api/migrations/0001_initial.py b/src/pretix/api/migrations/0001_initial.py
index d56fb19ef7..b768aebbfc 100644
--- a/src/pretix/api/migrations/0001_initial.py
+++ b/src/pretix/api/migrations/0001_initial.py
@@ -46,7 +46,7 @@ class Migration(migrations.Migration):
                 ('updated', models.DateTimeField(auto_now=True)),
                 ('name', models.CharField(max_length=255, verbose_name='Application name')),
                 ('redirect_uris', models.TextField(help_text='Allowed URIs list, space separated',
-                                                   validators=[oauth2_provider.validators.validate_uris],
+                                                   validators=[oauth2_provider.validators.URIValidator],
                                                    verbose_name='Redirection URIs')),
                 ('client_id',
                  models.CharField(db_index=True, default=oauth2_provider.generators.generate_client_id, max_length=100,
diff --git a/src/pretix/api/models.py b/src/pretix/api/models.py
index 189d04efb2..7a62d0e66a 100644
--- a/src/pretix/api/models.py
+++ b/src/pretix/api/models.py
@@ -11,13 +11,13 @@ from oauth2_provider.models import (
     AbstractAccessToken, AbstractApplication, AbstractGrant,
     AbstractRefreshToken,
 )
-from oauth2_provider.validators import validate_uris
+from oauth2_provider.validators import URIValidator
 
 
 class OAuthApplication(AbstractApplication):
     name = models.CharField(verbose_name=_("Application name"), max_length=255, blank=False)
     redirect_uris = models.TextField(
-        blank=False, validators=[validate_uris],
+        blank=False, validators=[URIValidator],
         verbose_name=_("Redirection URIs"),
         help_text=_("Allowed URIs list, space separated")
     )
diff --git a/src/pretix/api/views/checkin.py b/src/pretix/api/views/checkin.py
index 964d568629..f5931b20ab 100644
--- a/src/pretix/api/views/checkin.py
+++ b/src/pretix/api/views/checkin.py
@@ -32,7 +32,7 @@ class CheckinListViewSet(viewsets.ModelViewSet):
     serializer_class = CheckinListSerializer
     queryset = CheckinList.objects.none()
     filter_backends = (DjangoFilterBackend,)
-    filter_class = CheckinListFilter
+    filterset_class = CheckinListFilter
     permission = 'can_view_orders'
     write_permission = 'can_change_event_settings'
 
@@ -175,7 +175,7 @@ class CheckinListPositionViewSet(viewsets.ReadOnlyModelViewSet):
         },
     }
 
-    filter_class = CheckinOrderPositionFilter
+    filterset_class = CheckinOrderPositionFilter
     permission = 'can_view_orders'
     write_permission = 'can_change_orders'
 
diff --git a/src/pretix/api/views/event.py b/src/pretix/api/views/event.py
index cb92fc1106..d685129025 100644
--- a/src/pretix/api/views/event.py
+++ b/src/pretix/api/views/event.py
@@ -129,7 +129,7 @@ class SubEventViewSet(ConditionalListView, viewsets.ReadOnlyModelViewSet):
     serializer_class = SubEventSerializer
     queryset = ItemCategory.objects.none()
     filter_backends = (DjangoFilterBackend, filters.OrderingFilter)
-    filter_class = SubEventFilter
+    filterset_class = SubEventFilter
 
     def get_queryset(self):
         return self.request.event.subevents.prefetch_related(
diff --git a/src/pretix/api/views/item.py b/src/pretix/api/views/item.py
index 27585f7248..b89d5c8e3b 100644
--- a/src/pretix/api/views/item.py
+++ b/src/pretix/api/views/item.py
@@ -41,7 +41,7 @@ class ItemViewSet(ConditionalListView, viewsets.ModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
-    filter_class = ItemFilter
+    filterset_class = ItemFilter
     permission = 'can_change_items'
     write_permission = 'can_change_items'
 
@@ -207,7 +207,7 @@ class ItemCategoryViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = ItemCategorySerializer
     queryset = ItemCategory.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter)
-    filter_class = ItemCategoryFilter
+    filterset_class = ItemCategoryFilter
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
     permission = 'can_change_items'
@@ -261,7 +261,7 @@ class QuestionViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = QuestionSerializer
     queryset = Question.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter)
-    filter_class = QuestionFilter
+    filterset_class = QuestionFilter
     ordering_fields = ('id', 'position')
     ordering = ('position', 'id')
     permission = 'can_change_items'
@@ -359,7 +359,7 @@ class QuotaViewSet(ConditionalListView, viewsets.ModelViewSet):
     serializer_class = QuotaSerializer
     queryset = Quota.objects.none()
     filter_backends = (DjangoFilterBackend, OrderingFilter,)
-    filter_class = QuotaFilter
+    filterset_class = QuotaFilter
     ordering_fields = ('id', 'size')
     ordering = ('id',)
     permission = 'can_change_items'
diff --git a/src/pretix/api/views/order.py b/src/pretix/api/views/order.py
index 90c40061ff..7e3112543f 100644
--- a/src/pretix/api/views/order.py
+++ b/src/pretix/api/views/order.py
@@ -45,10 +45,10 @@ from pretix.base.signals import order_placed, register_ticket_outputs
 
 
 class OrderFilter(FilterSet):
-    email = django_filters.CharFilter(name='email', lookup_expr='iexact')
-    code = django_filters.CharFilter(name='code', lookup_expr='iexact')
-    status = django_filters.CharFilter(name='status', lookup_expr='iexact')
-    modified_since = django_filters.IsoDateTimeFilter(name='last_modified', lookup_expr='gte')
+    email = django_filters.CharFilter(field_name='email', lookup_expr='iexact')
+    code = django_filters.CharFilter(field_name='code', lookup_expr='iexact')
+    status = django_filters.CharFilter(field_name='status', lookup_expr='iexact')
+    modified_since = django_filters.IsoDateTimeFilter(field_name='last_modified', lookup_expr='gte')
 
     class Meta:
         model = Order
@@ -61,7 +61,7 @@ class OrderViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('datetime',)
     ordering_fields = ('datetime', 'code', 'status')
-    filter_class = OrderFilter
+    filterset_class = OrderFilter
     lookup_field = 'code'
     permission = 'can_view_orders'
     write_permission = 'can_change_orders'
@@ -307,7 +307,7 @@ class OrderViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
 
 
 class OrderPositionFilter(FilterSet):
-    order = django_filters.CharFilter(name='order', lookup_expr='code__iexact')
+    order = django_filters.CharFilter(field_name='order', lookup_expr='code__iexact')
     has_checkin = django_filters.rest_framework.BooleanFilter(method='has_checkin_qs')
     attendee_name = django_filters.CharFilter(method='attendee_name_qs')
     search = django_filters.CharFilter(method='search_qs')
@@ -345,7 +345,7 @@ class OrderPositionViewSet(viewsets.ReadOnlyModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('order__datetime', 'positionid')
     ordering_fields = ('order__code', 'order__datetime', 'positionid', 'attendee_name', 'order__status',)
-    filter_class = OrderPositionFilter
+    filterset_class = OrderPositionFilter
     permission = 'can_view_orders'
 
     def get_queryset(self):
@@ -590,7 +590,7 @@ class RefundViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
 class InvoiceFilter(FilterSet):
     refers = django_filters.CharFilter(method='refers_qs')
     number = django_filters.CharFilter(method='nr_qs')
-    order = django_filters.CharFilter(name='order', lookup_expr='code__iexact')
+    order = django_filters.CharFilter(field_name='order', lookup_expr='code__iexact')
 
     def refers_qs(self, queryset, name, value):
         return queryset.annotate(
@@ -617,7 +617,7 @@ class InvoiceViewSet(viewsets.ReadOnlyModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('nr',)
     ordering_fields = ('nr', 'date')
-    filter_class = InvoiceFilter
+    filterset_class = InvoiceFilter
     permission = 'can_view_orders'
     lookup_url_kwarg = 'number'
     lookup_field = 'nr'
diff --git a/src/pretix/api/views/organizer.py b/src/pretix/api/views/organizer.py
index b2ab942a06..b23f03f7b8 100644
--- a/src/pretix/api/views/organizer.py
+++ b/src/pretix/api/views/organizer.py
@@ -12,7 +12,7 @@ class OrganizerViewSet(viewsets.ReadOnlyModelViewSet):
     lookup_url_kwarg = 'organizer'
 
     def get_queryset(self):
-        if self.request.user.is_authenticated():
+        if self.request.user.is_authenticated:
             if self.request.user.has_active_staff_session(self.request.session.session_key):
                 return Organizer.objects.all()
             elif isinstance(self.request.auth, OAuthAccessToken):
diff --git a/src/pretix/api/views/voucher.py b/src/pretix/api/views/voucher.py
index 73e7f8cf1c..e31157cc20 100644
--- a/src/pretix/api/views/voucher.py
+++ b/src/pretix/api/views/voucher.py
@@ -34,7 +34,7 @@ class VoucherViewSet(viewsets.ModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('id',)
     ordering_fields = ('id', 'code', 'max_usages', 'valid_until', 'value')
-    filter_class = VoucherFilter
+    filterset_class = VoucherFilter
     permission = 'can_view_vouchers'
     write_permission = 'can_change_vouchers'
 
diff --git a/src/pretix/api/views/waitinglist.py b/src/pretix/api/views/waitinglist.py
index 36f6e8bf7a..cf649dc435 100644
--- a/src/pretix/api/views/waitinglist.py
+++ b/src/pretix/api/views/waitinglist.py
@@ -28,7 +28,7 @@ class WaitingListViewSet(viewsets.ModelViewSet):
     filter_backends = (DjangoFilterBackend, OrderingFilter)
     ordering = ('created',)
     ordering_fields = ('id', 'created', 'email', 'item')
-    filter_class = WaitingListFilter
+    filterset_class = WaitingListFilter
     permission = 'can_view_orders'
     write_permission = 'can_change_orders'
 
diff --git a/src/pretix/base/forms/auth.py b/src/pretix/base/forms/auth.py
index 8162d3173f..f4f92d4ce6 100644
--- a/src/pretix/base/forms/auth.py
+++ b/src/pretix/base/forms/auth.py
@@ -39,7 +39,7 @@ class LoginForm(forms.Form):
         password = self.cleaned_data.get('password')
 
         if email and password:
-            self.user_cache = authenticate(email=email.lower(), password=password)
+            self.user_cache = authenticate(request=self.request, email=email.lower(), password=password)
             if self.user_cache is None:
                 raise forms.ValidationError(
                     self.error_messages['invalid_login'],
diff --git a/src/pretix/base/middleware.py b/src/pretix/base/middleware.py
index ab0324c4d2..a2f1fedf28 100644
--- a/src/pretix/base/middleware.py
+++ b/src/pretix/base/middleware.py
@@ -3,8 +3,8 @@ from urllib.parse import urlsplit
 
 import pytz
 from django.conf import settings
-from django.core.urlresolvers import get_script_prefix
 from django.http import HttpRequest, HttpResponse
+from django.urls import get_script_prefix
 from django.utils import timezone, translation
 from django.utils.cache import patch_vary_headers
 from django.utils.deprecation import MiddlewareMixin
diff --git a/src/pretix/base/migrations/0098_auto_20180731_1243.py b/src/pretix/base/migrations/0098_auto_20180731_1243.py
new file mode 100644
index 0000000000..bf04b2306f
--- /dev/null
+++ b/src/pretix/base/migrations/0098_auto_20180731_1243.py
@@ -0,0 +1,56 @@
+# Generated by Django 2.0.7 on 2018-07-31 12:43
+
+import django.core.validators
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+import pretix.base.validators
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('pretixbase', '0097_auto_20180722_0804'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='logentry',
+            options={'ordering': ('-datetime', '-id')},
+        ),
+        migrations.AlterField(
+            model_name='orderpayment',
+            name='fee',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='payments', to='pretixbase.OrderFee'),
+        ),
+        migrations.AlterField(
+            model_name='organizer',
+            name='slug',
+            field=models.SlugField(help_text='Should be short, only contain lowercase letters, numbers, dots, and dashes. Every slug can only be used once. This is being used in URLs to refer to your organizer accounts and your events.', unique=True, validators=[django.core.validators.RegexValidator(message='The slug may only contain letters, numbers, dots and dashes.', regex='^[a-zA-Z0-9.-]+$'), pretix.base.validators.OrganizerSlugBlacklistValidator()], verbose_name='Short form'),
+        ),
+        migrations.AlterField(
+            model_name='staffsession',
+            name='user',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AlterField(
+            model_name='staffsessionauditlog',
+            name='impersonating',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL),
+        ),
+        migrations.AlterField(
+            model_name='staffsessionauditlog',
+            name='session',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='logs', to='pretixbase.StaffSession'),
+        ),
+        migrations.AlterField(
+            model_name='user',
+            name='locale',
+            field=models.CharField(choices=[('en', 'English'), ('de', 'German'), ('de-informal', 'German (informal)'), ('nl', 'Dutch'), ('da', 'Danish'), ('tr', 'Turkish'), ('pt-br', 'Portuguese (Brazil)')], default='en', max_length=50, verbose_name='Language'),
+        ),
+        migrations.AlterUniqueTogether(
+            name='event',
+            unique_together={('organizer', 'slug')},
+        ),
+    ]
diff --git a/src/pretix/base/models/auth.py b/src/pretix/base/models/auth.py
index 541e9f1298..eaed7e10f4 100644
--- a/src/pretix/base/models/auth.py
+++ b/src/pretix/base/models/auth.py
@@ -340,7 +340,7 @@ class User(AbstractBaseUser, PermissionsMixin, LoggingMixin):
 
 
 class StaffSession(models.Model):
-    user = models.ForeignKey('User')
+    user = models.ForeignKey('User', on_delete=models.PROTECT)
     date_start = models.DateTimeField(auto_now_add=True)
     date_end = models.DateTimeField(null=True, blank=True)
     session_key = models.CharField(max_length=255)
@@ -351,11 +351,11 @@ class StaffSession(models.Model):
 
 
 class StaffSessionAuditLog(models.Model):
-    session = models.ForeignKey('StaffSession', related_name='logs')
+    session = models.ForeignKey('StaffSession', related_name='logs', on_delete=models.PROTECT)
     datetime = models.DateTimeField(auto_now_add=True)
     url = models.CharField(max_length=255)
     method = models.CharField(max_length=255)
-    impersonating = models.ForeignKey('User', null=True, blank=True)
+    impersonating = models.ForeignKey('User', null=True, blank=True, on_delete=models.PROTECT)
 
     class Meta:
         ordering = ('datetime',)
diff --git a/src/pretix/base/models/checkin.py b/src/pretix/base/models/checkin.py
index a75d52573d..c6bab9e3d3 100644
--- a/src/pretix/base/models/checkin.py
+++ b/src/pretix/base/models/checkin.py
@@ -8,12 +8,12 @@ from pretix.base.models import LoggedModel
 
 
 class CheckinList(LoggedModel):
-    event = models.ForeignKey('Event', related_name='checkin_lists')
+    event = models.ForeignKey('Event', related_name='checkin_lists', on_delete=models.CASCADE)
     name = models.CharField(max_length=190)
     all_products = models.BooleanField(default=True, verbose_name=_("All products (including newly created ones)"))
     limit_products = models.ManyToManyField('Item', verbose_name=_("Limit to products"), blank=True)
     subevent = models.ForeignKey('SubEvent', null=True, blank=True,
-                                 verbose_name=pgettext_lazy('subevent', 'Date'))
+                                 verbose_name=pgettext_lazy('subevent', 'Date'), on_delete=models.CASCADE)
     include_pending = models.BooleanField(verbose_name=pgettext_lazy('checkin', 'Include pending orders'),
                                           default=False,
                                           help_text=_('With this option, people will be able to check in even if the '
@@ -157,7 +157,7 @@ class Checkin(models.Model):
     """
     A check-in object is created when a person enters the event.
     """
-    position = models.ForeignKey('pretixbase.OrderPosition', related_name='checkins')
+    position = models.ForeignKey('pretixbase.OrderPosition', related_name='checkins', on_delete=models.CASCADE)
     datetime = models.DateTimeField(default=now)
     nonce = models.CharField(max_length=190, null=True, blank=True)
     list = models.ForeignKey(
diff --git a/src/pretix/base/models/event.py b/src/pretix/base/models/event.py
index 0f058fb45d..7568fc9a9e 100644
--- a/src/pretix/base/models/event.py
+++ b/src/pretix/base/models/event.py
@@ -265,6 +265,7 @@ class Event(EventMixin, LoggedModel):
         verbose_name = _("Event")
         verbose_name_plural = _("Events")
         ordering = ("date_from", "name")
+        unique_together = (('organizer', 'slug'),)
 
     def __str__(self):
         return str(self.name)
diff --git a/src/pretix/base/models/invoices.py b/src/pretix/base/models/invoices.py
index 76feb602fa..8b9962dd12 100644
--- a/src/pretix/base/models/invoices.py
+++ b/src/pretix/base/models/invoices.py
@@ -64,14 +64,14 @@ class Invoice(models.Model):
     :param file: The filename of the rendered invoice
     :type file: File
     """
-    order = models.ForeignKey('Order', related_name='invoices', db_index=True)
+    order = models.ForeignKey('Order', related_name='invoices', db_index=True, on_delete=models.CASCADE)
     organizer = models.ForeignKey('Organizer', related_name='invoices', db_index=True, on_delete=models.PROTECT)
-    event = models.ForeignKey('Event', related_name='invoices', db_index=True)
+    event = models.ForeignKey('Event', related_name='invoices', db_index=True, on_delete=models.CASCADE)
     prefix = models.CharField(max_length=160, db_index=True)
     invoice_no = models.CharField(max_length=19, db_index=True)
     full_invoice_no = models.CharField(max_length=190, db_index=True)
     is_cancellation = models.BooleanField(default=False)
-    refers = models.ForeignKey('Invoice', related_name='refered', null=True, blank=True)
+    refers = models.ForeignKey('Invoice', related_name='refered', null=True, blank=True, on_delete=models.CASCADE)
     invoice_from = models.TextField()
     invoice_to = models.TextField()
     date = models.DateField(default=today)
@@ -175,7 +175,7 @@ class InvoiceLine(models.Model):
     :param tax_name: The name of the applied tax rate
     :type tax_name: str
     """
-    invoice = models.ForeignKey('Invoice', related_name='lines')
+    invoice = models.ForeignKey('Invoice', related_name='lines', on_delete=models.CASCADE)
     position = models.PositiveIntegerField(default=0)
     description = models.TextField()
     gross_value = models.DecimalField(max_digits=10, decimal_places=2)
diff --git a/src/pretix/base/models/items.py b/src/pretix/base/models/items.py
index 54087a9e68..38bc7d9ffb 100644
--- a/src/pretix/base/models/items.py
+++ b/src/pretix/base/models/items.py
@@ -447,7 +447,8 @@ class ItemVariation(models.Model):
     """
     item = models.ForeignKey(
         Item,
-        related_name='variations'
+        related_name='variations',
+        on_delete=models.CASCADE
     )
     value = I18nCharField(
         max_length=255,
@@ -562,12 +563,14 @@ class ItemAddOn(models.Model):
     """
     base_item = models.ForeignKey(
         Item,
-        related_name='addons'
+        related_name='addons',
+        on_delete=models.CASCADE
     )
     addon_category = models.ForeignKey(
         ItemCategory,
         related_name='addon_to',
-        verbose_name=_('Category')
+        verbose_name=_('Category'),
+        on_delete=models.CASCADE
     )
     min_count = models.PositiveIntegerField(
         default=0,
@@ -679,7 +682,8 @@ class Question(LoggedModel):
 
     event = models.ForeignKey(
         Event,
-        related_name="questions"
+        related_name="questions",
+        on_delete=models.CASCADE
     )
     question = I18nTextField(
         verbose_name=_("Question")
@@ -831,7 +835,7 @@ class Question(LoggedModel):
 
 
 class QuestionOption(models.Model):
-    question = models.ForeignKey('Question', related_name='options')
+    question = models.ForeignKey('Question', related_name='options', on_delete=models.CASCADE)
     identifier = models.CharField(max_length=190)
     answer = I18nCharField(verbose_name=_('Answer'))
     position = models.IntegerField(default=0)
diff --git a/src/pretix/base/models/orders.py b/src/pretix/base/models/orders.py
index 4b0fd8923f..10557354c6 100644
--- a/src/pretix/base/models/orders.py
+++ b/src/pretix/base/models/orders.py
@@ -119,7 +119,8 @@ class Order(LoggedModel):
     event = models.ForeignKey(
         Event,
         verbose_name=_("Event"),
-        related_name="orders"
+        related_name="orders",
+        on_delete=models.CASCADE
     )
     email = models.EmailField(
         null=True, blank=True,
@@ -226,11 +227,11 @@ class Order(LoggedModel):
             pending_sum_rc=-1 * F('payment_sum') + Coalesce(F('refund_sum'), 0),
         ).annotate(
             is_overpaid=Case(
-                When(~Q(status__in=[Order.STATUS_REFUNDED, Order.STATUS_CANCELED]) & Q(pending_sum_t__lt=0),
+                When(~Q(status__in=(Order.STATUS_REFUNDED, Order.STATUS_CANCELED)) & Q(pending_sum_t__lt=0),
                      then=Value('1')),
-                When(Q(status__in=[Order.STATUS_REFUNDED, Order.STATUS_CANCELED]) & Q(pending_sum_rc__lt=0),
+                When(Q(status__in=(Order.STATUS_REFUNDED, Order.STATUS_CANCELED)) & Q(pending_sum_rc__lt=0),
                      then=Value('1')),
-                When(Q(status__in=[Order.STATUS_EXPIRED, Order.STATUS_PENDING]) & Q(pending_sum_t__lte=0),
+                When(Q(status__in=(Order.STATUS_EXPIRED, Order.STATUS_PENDING)) & Q(pending_sum_t__lte=0),
                      then=Value('1')),
                 default=Value('0'),
                 output_field=models.IntegerField()
@@ -544,14 +545,14 @@ class QuestionAnswer(models.Model):
     """
     orderposition = models.ForeignKey(
         'OrderPosition', null=True, blank=True,
-        related_name='answers'
+        related_name='answers', on_delete=models.CASCADE
     )
     cartposition = models.ForeignKey(
         'CartPosition', null=True, blank=True,
-        related_name='answers'
+        related_name='answers', on_delete=models.CASCADE
     )
     question = models.ForeignKey(
-        Question, related_name='answers'
+        Question, related_name='answers', on_delete=models.CASCADE
     )
     options = models.ManyToManyField(
         QuestionOption, related_name='answers', blank=True
@@ -699,7 +700,7 @@ class AbstractPosition(models.Model):
         help_text=_("Empty, if this product is not an admission ticket")
     )
     voucher = models.ForeignKey(
-        'Voucher', null=True, blank=True
+        'Voucher', null=True, blank=True, on_delete=models.CASCADE
     )
     addon_to = models.ForeignKey(
         'self', null=True, blank=True, on_delete=models.CASCADE, related_name='addons'
@@ -829,7 +830,7 @@ class OrderPayment(models.Model):
     )
     fee = models.ForeignKey(
         'OrderFee',
-        null=True, blank=True, related_name='payments'
+        null=True, blank=True, related_name='payments', on_delete=models.SET_NULL
     )
     migrated = models.BooleanField(default=False)
 
@@ -1444,7 +1445,8 @@ class CartPosition(AbstractPosition):
     """
     event = models.ForeignKey(
         Event,
-        verbose_name=_("Event")
+        verbose_name=_("Event"),
+        on_delete=models.CASCADE
     )
     cart_id = models.CharField(
         max_length=255, null=True, blank=True, db_index=True,
@@ -1488,7 +1490,7 @@ class CartPosition(AbstractPosition):
 
 class InvoiceAddress(models.Model):
     last_modified = models.DateTimeField(auto_now=True)
-    order = models.OneToOneField(Order, null=True, blank=True, related_name='invoice_address')
+    order = models.OneToOneField(Order, null=True, blank=True, related_name='invoice_address', on_delete=models.CASCADE)
     is_business = models.BooleanField(default=False, verbose_name=_('Business customer'))
     company = models.CharField(max_length=255, blank=True, verbose_name=_('Company name'))
     name = models.CharField(max_length=255, verbose_name=_('Full name'), blank=True)
diff --git a/src/pretix/base/models/organizer.py b/src/pretix/base/models/organizer.py
index bffa2da803..d76c7f4d0b 100644
--- a/src/pretix/base/models/organizer.py
+++ b/src/pretix/base/models/organizer.py
@@ -42,6 +42,7 @@ class Organizer(LoggedModel):
             OrganizerSlugBlacklistValidator()
         ],
         verbose_name=_("Short form"),
+        unique=True
     )
 
     class Meta:
diff --git a/src/pretix/base/models/tax.py b/src/pretix/base/models/tax.py
index 13a7d9b8ee..ca9a91db0c 100644
--- a/src/pretix/base/models/tax.py
+++ b/src/pretix/base/models/tax.py
@@ -60,7 +60,7 @@ EU_CURRENCIES = {
 
 
 class TaxRule(LoggedModel):
-    event = models.ForeignKey('Event', related_name='tax_rules')
+    event = models.ForeignKey('Event', related_name='tax_rules', on_delete=models.CASCADE)
     name = I18nCharField(
         verbose_name=_('Name'),
         help_text=_('Should be short, e.g. "VAT"'),
diff --git a/src/pretix/base/models/vouchers.py b/src/pretix/base/models/vouchers.py
index 34991aa5b3..c309c4768a 100644
--- a/src/pretix/base/models/vouchers.py
+++ b/src/pretix/base/models/vouchers.py
@@ -137,14 +137,14 @@ class Voucher(LoggedModel):
     item = models.ForeignKey(
         Item, related_name='vouchers',
         verbose_name=_("Product"),
-        null=True, blank=True,
+        null=True, blank=True, on_delete=models.CASCADE,
         help_text=_(
             "This product is added to the user's cart if the voucher is redeemed."
         )
     )
     variation = models.ForeignKey(
         ItemVariation, related_name='vouchers',
-        null=True, blank=True,
+        null=True, blank=True, on_delete=models.CASCADE,
         verbose_name=_("Product variation"),
         help_text=_(
             "This variation of the product select above is being used."
@@ -152,7 +152,7 @@ class Voucher(LoggedModel):
     )
     quota = models.ForeignKey(
         Quota, related_name='quota',
-        null=True, blank=True,
+        null=True, blank=True, on_delete=models.CASCADE,
         verbose_name=_("Quota"),
         help_text=_(
             "If enabled, the voucher is valid for any product affected by this quota."
diff --git a/src/pretix/base/models/waitinglist.py b/src/pretix/base/models/waitinglist.py
index 51be7dbf5b..886b97be79 100644
--- a/src/pretix/base/models/waitinglist.py
+++ b/src/pretix/base/models/waitinglist.py
@@ -43,10 +43,11 @@ class WaitingListEntry(LoggedModel):
         'Voucher',
         verbose_name=_("Assigned voucher"),
         null=True, blank=True,
-        related_name='waitinglistentries'
+        related_name='waitinglistentries',
+        on_delete=models.CASCADE
     )
     item = models.ForeignKey(
-        Item, related_name='waitinglistentries',
+        Item, related_name='waitinglistentries', on_delete=models.CASCADE,
         verbose_name=_("Product"),
         help_text=_(
             "The product the user waits for."
@@ -54,7 +55,7 @@ class WaitingListEntry(LoggedModel):
     )
     variation = models.ForeignKey(
         ItemVariation, related_name='waitinglistentries',
-        null=True, blank=True,
+        null=True, blank=True, on_delete=models.CASCADE,
         verbose_name=_("Product variation"),
         help_text=_(
             "The variation of the product selected above."
diff --git a/src/pretix/base/services/invoices.py b/src/pretix/base/services/invoices.py
index 416574159b..da6ed1b780 100644
--- a/src/pretix/base/services/invoices.py
+++ b/src/pretix/base/services/invoices.py
@@ -171,7 +171,7 @@ def build_cancellation(invoice: Invoice):
 
 
 def generate_cancellation(invoice: Invoice, trigger_pdf=True):
-    cancellation = copy.copy(invoice)
+    cancellation = copy.deepcopy(invoice)
     cancellation.pk = None
     cancellation.invoice_no = None
     cancellation.prefix = None
diff --git a/src/pretix/base/services/orders.py b/src/pretix/base/services/orders.py
index f650833530..cbaa646a89 100644
--- a/src/pretix/base/services/orders.py
+++ b/src/pretix/base/services/orders.py
@@ -923,7 +923,7 @@ class OrderChangeManager:
             op.save()
 
         try:
-            ia = copy.copy(self.order.invoice_address)
+            ia = copy.deepcopy(self.order.invoice_address)
             ia.pk = None
             ia.order = split_order
             ia.save()
@@ -947,7 +947,7 @@ class OrderChangeManager:
             split_order.total += fee.value
 
         for fee in self.order.fees.exclude(fee_type=OrderFee.FEE_TYPE_PAYMENT):
-            new_fee = copy.copy(fee)
+            new_fee = copy.deepcopy(fee)
             new_fee.pk = None
             new_fee.order = split_order
             split_order.total += new_fee.value
diff --git a/src/pretix/base/templates/error.html b/src/pretix/base/templates/error.html
index fcb1f223cc..ad1e120a77 100644
--- a/src/pretix/base/templates/error.html
+++ b/src/pretix/base/templates/error.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/base/templates/pretixbase/cachedfiles/pending.html b/src/pretix/base/templates/pretixbase/cachedfiles/pending.html
index 36d99aff02..20a37feb7e 100644
--- a/src/pretix/base/templates/pretixbase/cachedfiles/pending.html
+++ b/src/pretix/base/templates/pretixbase/cachedfiles/pending.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/base/templatetags/rich_text.py b/src/pretix/base/templatetags/rich_text.py
index 98d5435776..6dd00262ca 100644
--- a/src/pretix/base/templatetags/rich_text.py
+++ b/src/pretix/base/templatetags/rich_text.py
@@ -63,7 +63,7 @@ ALLOWED_PROTOCOLS = ['http', 'https', 'mailto', 'tel']
 
 def safelink_callback(attrs, new=False):
     url = attrs.get((None, 'href'), '/')
-    if not is_safe_url(url) and not url.startswith('mailto:') and not url.startswith('tel:'):
+    if not is_safe_url(url, allowed_hosts=None) and not url.startswith('mailto:') and not url.startswith('tel:'):
         signer = signing.Signer(salt='safe-redirect')
         attrs[None, 'href'] = reverse('redirect') + '?url=' + urllib.parse.quote(signer.sign(url))
         attrs[None, 'target'] = '_blank'
diff --git a/src/pretix/base/templatetags/urlreplace.py b/src/pretix/base/templatetags/urlreplace.py
index 1dc6785701..6a5b4717f4 100644
--- a/src/pretix/base/templatetags/urlreplace.py
+++ b/src/pretix/base/templatetags/urlreplace.py
@@ -15,6 +15,6 @@ def url_replace(request, *pairs):
                 if key in dict_:
                     del dict_[key]
             else:
-                dict_[key] = p
+                dict_[key] = str(p)
             key = None
     return dict_.urlencode(safe='[]')
diff --git a/src/pretix/base/views/js_catalog.py b/src/pretix/base/views/js_catalog.py
index b2f475a661..ea315aaec6 100644
--- a/src/pretix/base/views/js_catalog.py
+++ b/src/pretix/base/views/js_catalog.py
@@ -1,7 +1,8 @@
 from django.utils import timezone
+from django.utils.translation.trans_real import DjangoTranslation
 from django.views.decorators.cache import cache_page
 from django.views.decorators.http import etag
-from django.views.i18n import get_javascript_catalog, render_javascript_catalog
+from django.views.i18n import JavaScriptCatalog, render_javascript_catalog
 
 # Yes, we want to regenerate this every time the module has been imported to
 # refresh the cache at least at every code deployment
@@ -18,6 +19,6 @@ js_info_dict = {
 @etag(lambda *s, **k: import_date)
 @cache_page(3600, key_prefix='js18n-%s' % import_date)
 def js_catalog(request, lang):
-    packages = ['pretix']
-    catalog, plural = get_javascript_catalog(lang, 'djangojs', packages)
-    return render_javascript_catalog(catalog, plural)
+    c = JavaScriptCatalog()
+    c.translation = DjangoTranslation(lang, domain='djangojs')
+    return render_javascript_catalog(c.get_catalog(), c.get_plural())
diff --git a/src/pretix/base/views/redirect.py b/src/pretix/base/views/redirect.py
index ad58bec3c6..bc17f943c6 100644
--- a/src/pretix/base/views/redirect.py
+++ b/src/pretix/base/views/redirect.py
@@ -1,8 +1,8 @@
 import urllib.parse
 
 from django.core import signing
-from django.core.urlresolvers import reverse
 from django.http import HttpResponseBadRequest, HttpResponseRedirect
+from django.urls import reverse
 
 
 def redir_view(request):
diff --git a/src/pretix/control/context.py b/src/pretix/control/context.py
index 2a6c2e2990..d09a11fd5d 100644
--- a/src/pretix/control/context.py
+++ b/src/pretix/control/context.py
@@ -2,8 +2,8 @@ import sys
 from importlib import import_module
 
 from django.conf import settings
-from django.core.urlresolvers import Resolver404, get_script_prefix, resolve
 from django.db.models import Q
+from django.urls import Resolver404, get_script_prefix, resolve
 from django.utils.translation import get_language
 
 from pretix.base.models.auth import StaffSession
diff --git a/src/pretix/control/forms/item.py b/src/pretix/control/forms/item.py
index 77a1f03954..f8438aeaf7 100644
--- a/src/pretix/control/forms/item.py
+++ b/src/pretix/control/forms/item.py
@@ -78,7 +78,7 @@ class QuotaForm(I18nModelForm):
         self.instance = kwargs.get('instance', None)
         self.event = kwargs.get('event')
         items = kwargs.pop('items', None) or self.event.items.prefetch_related('variations')
-        self.original_instance = copy.copy(self.instance) if self.instance else None
+        self.original_instance = copy.deepcopy(self.instance) if self.instance else None
         initial = kwargs.get('initial', {})
         if self.instance and self.instance.pk:
             initial['itemvars'] = [str(i.pk) for i in self.instance.items.all()] + [
@@ -370,6 +370,7 @@ class ItemVariationsFormSet(I18nFormSet):
             auto_id=self.auto_id,
             prefix=self.add_prefix('__prefix__'),
             empty_permitted=True,
+            use_required_attribute=False,
             locales=self.locales,
             event=self.event
         )
@@ -430,6 +431,7 @@ class ItemAddOnsFormSet(I18nFormSet):
             auto_id=self.auto_id,
             prefix=self.add_prefix('__prefix__'),
             empty_permitted=True,
+            use_required_attribute=False,
             locales=self.locales,
             event=self.event
         )
diff --git a/src/pretix/control/forms/subevents.py b/src/pretix/control/forms/subevents.py
index 219b2a670a..f933e0c4dd 100644
--- a/src/pretix/control/forms/subevents.py
+++ b/src/pretix/control/forms/subevents.py
@@ -150,6 +150,7 @@ class QuotaFormSet(I18nInlineFormSet):
             auto_id=self.auto_id,
             prefix=self.add_prefix('__prefix__'),
             empty_permitted=True,
+            use_required_attribute=False,
             locales=self.locales,
             event=self.event,
             items=self.items
@@ -196,6 +197,7 @@ class CheckinListFormSet(I18nInlineFormSet):
             auto_id=self.auto_id,
             prefix=self.add_prefix('__prefix__'),
             empty_permitted=True,
+            use_required_attribute=False,
             event=self.event,
         )
         self.add_fields(form, None)
diff --git a/src/pretix/control/forms/vouchers.py b/src/pretix/control/forms/vouchers.py
index 55a4b34dc8..e231f51115 100644
--- a/src/pretix/control/forms/vouchers.py
+++ b/src/pretix/control/forms/vouchers.py
@@ -45,7 +45,7 @@ class VoucherForm(I18nModelForm):
         instance = kwargs.get('instance')
         initial = kwargs.get('initial')
         if instance:
-            self.initial_instance_data = copy.copy(instance)
+            self.initial_instance_data = copy.deepcopy(instance)
             try:
                 if instance.variation:
                     initial['itemvar'] = '%d-%d' % (instance.item.pk, instance.variation.pk)
@@ -139,7 +139,7 @@ class VoucherForm(I18nModelForm):
 
         if 'codes' in data:
             data['codes'] = [a.strip() for a in data.get('codes', '').strip().split("\n") if a]
-            cnt = len(data['codes']) * data['max_usages']
+            cnt = len(data['codes']) * data.get('max_usages', 0)
         else:
             cnt = data['max_usages']
 
@@ -217,7 +217,7 @@ class VoucherBulkForm(VoucherForm):
     def save(self, event, *args, **kwargs):
         objs = []
         for code in self.cleaned_data['codes']:
-            obj = copy.copy(self.instance)
+            obj = copy.deepcopy(self.instance)
             obj.event = event
             obj.code = code
             data = dict(self.cleaned_data)
diff --git a/src/pretix/control/middleware.py b/src/pretix/control/middleware.py
index cd99705efd..45d07d1a30 100644
--- a/src/pretix/control/middleware.py
+++ b/src/pretix/control/middleware.py
@@ -2,9 +2,9 @@ from urllib.parse import quote, urljoin, urlparse
 
 from django.conf import settings
 from django.contrib.auth import REDIRECT_FIELD_NAME, logout
-from django.core.urlresolvers import get_script_prefix, resolve, reverse
 from django.http import Http404
 from django.shortcuts import get_object_or_404, redirect, resolve_url
+from django.urls import get_script_prefix, resolve, reverse
 from django.utils.deprecation import MiddlewareMixin
 from django.utils.encoding import force_str
 from django.utils.translation import ugettext as _
diff --git a/src/pretix/control/templates/pretixcontrol/auth/base.html b/src/pretix/control/templates/pretixcontrol/auth/base.html
index 7cf1fa0c88..54e15129d7 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/base.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/base.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/control/templates/pretixcontrol/auth/forgot.html b/src/pretix/control/templates/pretixcontrol/auth/forgot.html
index 3140a8497c..7e456284b6 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/forgot.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/forgot.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% block content %}
 	<form class="form-signin" action="" method="post">
diff --git a/src/pretix/control/templates/pretixcontrol/auth/invite.html b/src/pretix/control/templates/pretixcontrol/auth/invite.html
index b10a5a563c..a4a4c3ab3c 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/invite.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/invite.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% block content %}
 	<form class="form-signin" action="" method="post">
diff --git a/src/pretix/control/templates/pretixcontrol/auth/login.html b/src/pretix/control/templates/pretixcontrol/auth/login.html
index 75f5518e2c..a51f18f9da 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/login.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/login.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% block content %}
     <form class="form-signin" action="" method="post">
         {% bootstrap_form_errors form type='all' layout='inline' %}
diff --git a/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html b/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html
index e06e531b4e..6c5c73aa8c 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/login_2fa.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load compress %}
 {% block content %}
     <form class="form-signin" action="" method="post" id="u2f-form">
diff --git a/src/pretix/control/templates/pretixcontrol/auth/oauth_authorization.html b/src/pretix/control/templates/pretixcontrol/auth/oauth_authorization.html
index e592488a07..3dc000903d 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/oauth_authorization.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/oauth_authorization.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% block content %}
     {% if not error %}
diff --git a/src/pretix/control/templates/pretixcontrol/auth/recover.html b/src/pretix/control/templates/pretixcontrol/auth/recover.html
index 2ff140d0d4..1caf09032c 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/recover.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/recover.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% block content %}
 	<form class="form-signin" action="" method="post">
diff --git a/src/pretix/control/templates/pretixcontrol/auth/register.html b/src/pretix/control/templates/pretixcontrol/auth/register.html
index 4d2e0646bf..4deee0d01b 100644
--- a/src/pretix/control/templates/pretixcontrol/auth/register.html
+++ b/src/pretix/control/templates/pretixcontrol/auth/register.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/auth/base.html" %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% block content %}
 	<form class="form-signin" action="" method="post">
diff --git a/src/pretix/control/templates/pretixcontrol/base.html b/src/pretix/control/templates/pretixcontrol/base.html
index 764684016c..21af5a2a6e 100644
--- a/src/pretix/control/templates/pretixcontrol/base.html
+++ b/src/pretix/control/templates/pretixcontrol/base.html
@@ -1,5 +1,5 @@
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% load hijack_tags %}
 {% load statici18n %}
diff --git a/src/pretix/control/templates/pretixcontrol/event/base.html b/src/pretix/control/templates/pretixcontrol/event/base.html
index d2fa47e8f9..2ce387c4f5 100644
--- a/src/pretix/control/templates/pretixcontrol/event/base.html
+++ b/src/pretix/control/templates/pretixcontrol/event/base.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% block title %}{{ request.event.name }}{% endblock %}
 
 {% block nav %}
diff --git a/src/pretix/control/templates/pretixcontrol/event/index.html b/src/pretix/control/templates/pretixcontrol/event/index.html
index 84fa72920d..c391b78a22 100644
--- a/src/pretix/control/templates/pretixcontrol/event/index.html
+++ b/src/pretix/control/templates/pretixcontrol/event/index.html
@@ -2,7 +2,7 @@
 {% load i18n %}
 {% load eventurl %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% block title %}{{ request.event.name }}{% endblock %}
 {% block content %}
     <h1>
diff --git a/src/pretix/control/templates/pretixcontrol/event/logs.html b/src/pretix/control/templates/pretixcontrol/event/logs.html
index 3c8555b661..3ad186eaaf 100644
--- a/src/pretix/control/templates/pretixcontrol/event/logs.html
+++ b/src/pretix/control/templates/pretixcontrol/event/logs.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/items/base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% block title %}{% trans "Event logs" %}{% endblock %}
 {% block inside %}
     <h1>{% trans "Event logs" %}</h1>
diff --git a/src/pretix/control/templates/pretixcontrol/event/permissions.html b/src/pretix/control/templates/pretixcontrol/event/permissions.html
index c7ccc67487..4a7d8cb1bd 100644
--- a/src/pretix/control/templates/pretixcontrol/event/permissions.html
+++ b/src/pretix/control/templates/pretixcontrol/event/permissions.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/event/settings_base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load bootstrap3 %}
 {% block inside %}
 
diff --git a/src/pretix/control/templates/pretixcontrol/event/widget.html b/src/pretix/control/templates/pretixcontrol/event/widget.html
index 737ba60d19..fd36ce4cdc 100644
--- a/src/pretix/control/templates/pretixcontrol/event/widget.html
+++ b/src/pretix/control/templates/pretixcontrol/event/widget.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/event/settings_base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load bootstrap3 %}
 {% load eventurl %}
 {% load eventsignal %}
diff --git a/src/pretix/control/templates/pretixcontrol/includes/logs.html b/src/pretix/control/templates/pretixcontrol/includes/logs.html
index 624efb8ce4..aa2c4ad339 100644
--- a/src/pretix/control/templates/pretixcontrol/includes/logs.html
+++ b/src/pretix/control/templates/pretixcontrol/includes/logs.html
@@ -1,4 +1,4 @@
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 <ul class="list-group">
     {% for log in obj.all_logentries %}
diff --git a/src/pretix/control/templates/pretixcontrol/pdf/index.html b/src/pretix/control/templates/pretixcontrol/pdf/index.html
index 893b0d2273..f18f060978 100644
--- a/src/pretix/control/templates/pretixcontrol/pdf/index.html
+++ b/src/pretix/control/templates/pretixcontrol/pdf/index.html
@@ -1,6 +1,6 @@
 {% extends "pretixcontrol/event/base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load compress %}
 {% block title %}{% trans "PDF Editor" %}{% endblock %}
 {% block custom_header %}
diff --git a/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css b/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css
index 5224391b8c..438883da10 100644
--- a/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css
+++ b/src/pretix/control/templates/pretixcontrol/pdf/webfonts.css
@@ -1,4 +1,4 @@
-{% load staticfiles %}
+{% load static %}
 
 {% for family, styles in fonts.items %}
 {% for style, formats in styles.items %}
diff --git a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_u2f.html b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_u2f.html
index 8965073921..1f99800437 100644
--- a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_u2f.html
+++ b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_u2f.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% load compress %}
 {% block title %}{% trans "Add a two-factor authentication device" %}{% endblock %}
 {% block content %}
diff --git a/src/pretix/control/templates/pretixcontrol/user/reauth.html b/src/pretix/control/templates/pretixcontrol/user/reauth.html
index 4cc6297dd8..f1a942204f 100644
--- a/src/pretix/control/templates/pretixcontrol/user/reauth.html
+++ b/src/pretix/control/templates/pretixcontrol/user/reauth.html
@@ -2,7 +2,7 @@
 {% load i18n %}
 {% load bootstrap3 %}
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 {% block content %}
     <form class="form-signin" id="u2f-form" action="" method="post">
         {% csrf_token %}
diff --git a/src/pretix/control/views/auth.py b/src/pretix/control/views/auth.py
index 2982ab7fb4..f1a3916db2 100644
--- a/src/pretix/control/views/auth.py
+++ b/src/pretix/control/views/auth.py
@@ -48,13 +48,13 @@ def login(request):
                 request.session['pretix_auth_2fa_user'] = form.user_cache.pk
                 request.session['pretix_auth_2fa_time'] = str(int(time.time()))
                 twofa_url = reverse('control:auth.login.2fa')
-                if "next" in request.GET and is_safe_url(request.GET.get("next")):
+                if "next" in request.GET and is_safe_url(request.GET.get("next"), allowed_hosts=None):
                     twofa_url += '?next=' + quote(request.GET.get('next'))
                 return redirect(twofa_url)
             else:
                 auth_login(request, form.user_cache)
                 request.session['pretix_auth_login_time'] = int(time.time())
-                if "next" in request.GET and is_safe_url(request.GET.get("next")):
+                if "next" in request.GET and is_safe_url(request.GET.get("next"), allowed_hosts=None):
                     return redirect(request.GET.get("next"))
                 return redirect(reverse('control:index'))
     else:
@@ -72,7 +72,7 @@ def logout(request):
     auth_logout(request)
     request.session['pretix_auth_login_time'] = 0
     next = reverse('control:auth.login')
-    if 'next' in request.GET and is_safe_url(request.GET.get('next')):
+    if 'next' in request.GET and is_safe_url(request.GET.get('next'), allowed_hosts=None):
         next += '?next=' + quote(request.GET.get('next'))
     return redirect(next)
 
@@ -94,7 +94,7 @@ def register(request):
                 locale=request.LANGUAGE_CODE,
                 timezone=request.timezone if hasattr(request, 'timezone') else settings.TIME_ZONE
             )
-            user = authenticate(email=user.email, password=form.cleaned_data['password'])
+            user = authenticate(request=request, email=user.email, password=form.cleaned_data['password'])
             user.log_action('pretix.control.auth.user.created', user=user)
             auth_login(request, user)
             request.session['pretix_auth_login_time'] = int(time.time())
@@ -148,7 +148,7 @@ def invite(request, token):
                 locale=request.LANGUAGE_CODE,
                 timezone=request.timezone if hasattr(request, 'timezone') else settings.TIME_ZONE
             )
-            user = authenticate(email=user.email, password=form.cleaned_data['password'])
+            user = authenticate(request=request, email=user.email, password=form.cleaned_data['password'])
             user.log_action('pretix.control.auth.user.created', user=user)
             auth_login(request, user)
             request.session['pretix_auth_login_time'] = int(time.time())
@@ -329,7 +329,7 @@ class Login2FAView(TemplateView):
             request.session['pretix_auth_login_time'] = int(time.time())
             del request.session['pretix_auth_2fa_user']
             del request.session['pretix_auth_2fa_time']
-            if "next" in request.GET and is_safe_url(request.GET.get("next")):
+            if "next" in request.GET and is_safe_url(request.GET.get("next"), allowed_hosts=None):
                 return redirect(request.GET.get("next"))
             return redirect(reverse('control:index'))
         else:
diff --git a/src/pretix/control/views/checkin.py b/src/pretix/control/views/checkin.py
index 74ec3035f1..d5d41e9b2d 100644
--- a/src/pretix/control/views/checkin.py
+++ b/src/pretix/control/views/checkin.py
@@ -1,10 +1,10 @@
 import dateutil.parser
 from django.contrib import messages
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import Max, OuterRef, Subquery
 from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import get_object_or_404, redirect
+from django.urls import reverse
 from django.utils.functional import cached_property
 from django.utils.timezone import is_aware, make_aware, now
 from django.utils.translation import ugettext_lazy as _
diff --git a/src/pretix/control/views/dashboards.py b/src/pretix/control/views/dashboards.py
index 2790f2153a..0205ce6095 100644
--- a/src/pretix/control/views/dashboards.py
+++ b/src/pretix/control/views/dashboards.py
@@ -2,7 +2,6 @@ from decimal import Decimal
 
 import pytz
 from django.contrib.contenttypes.models import ContentType
-from django.core.urlresolvers import reverse
 from django.db.models import (
     Count, Exists, IntegerField, Max, Min, OuterRef, Q, Subquery, Sum,
 )
@@ -10,6 +9,7 @@ from django.db.models.functions import Coalesce, Greatest
 from django.dispatch import receiver
 from django.shortcuts import render
 from django.template.loader import get_template
+from django.urls import reverse
 from django.utils import formats
 from django.utils.formats import date_format
 from django.utils.html import escape
diff --git a/src/pretix/control/views/event.py b/src/pretix/control/views/event.py
index cc14ab35aa..3d9a7a0ead 100644
--- a/src/pretix/control/views/event.py
+++ b/src/pretix/control/views/event.py
@@ -9,7 +9,6 @@ from django.conf import settings
 from django.contrib import messages
 from django.contrib.contenttypes.models import ContentType
 from django.core.files import File
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import ProtectedError
 from django.http import (
@@ -17,6 +16,7 @@ from django.http import (
     JsonResponse,
 )
 from django.shortcuts import get_object_or_404, redirect
+from django.urls import reverse
 from django.utils import translation
 from django.utils.formats import date_format
 from django.utils.functional import cached_property
diff --git a/src/pretix/control/views/item.py b/src/pretix/control/views/item.py
index a0fffabf2c..b5a9d65115 100644
--- a/src/pretix/control/views/item.py
+++ b/src/pretix/control/views/item.py
@@ -2,12 +2,12 @@ import json
 
 from django.contrib import messages
 from django.core.files import File
-from django.core.urlresolvers import resolve, reverse
 from django.db import transaction
 from django.db.models import Count, F, Q
 from django.forms.models import inlineformset_factory
 from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import redirect
+from django.urls import resolve, reverse
 from django.utils.functional import cached_property
 from django.utils.timezone import now
 from django.utils.translation import ugettext, ugettext_lazy as _
diff --git a/src/pretix/control/views/main.py b/src/pretix/control/views/main.py
index ad4d6f0582..1a79be9612 100644
--- a/src/pretix/control/views/main.py
+++ b/src/pretix/control/views/main.py
@@ -1,5 +1,4 @@
 from django.conf import settings
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import (
     F, IntegerField, Max, Min, OuterRef, Prefetch, Subquery, Sum,
@@ -7,6 +6,7 @@ from django.db.models import (
 from django.db.models.functions import Coalesce, Greatest
 from django.http import JsonResponse
 from django.shortcuts import redirect
+from django.urls import reverse
 from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
 from django.utils.translation import ugettext, ugettext_lazy as _
diff --git a/src/pretix/control/views/orders.py b/src/pretix/control/views/orders.py
index 2cb360466e..a2daa5ed88 100644
--- a/src/pretix/control/views/orders.py
+++ b/src/pretix/control/views/orders.py
@@ -10,11 +10,11 @@ import vat_moss.id
 from django.conf import settings
 from django.contrib import messages
 from django.core.files import File
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import Count
 from django.http import FileResponse, Http404, HttpResponseNotAllowed
 from django.shortcuts import get_object_or_404, redirect, render
+from django.urls import reverse
 from django.utils import formats
 from django.utils.formats import date_format
 from django.utils.functional import cached_property
@@ -275,7 +275,7 @@ class OrderRefundCancel(OrderView):
             messages.success(self.request, _('The refund has been canceled.'))
         else:
             messages.error(self.request, _('This refund can not be canceled at the moment.'))
-        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next")):
+        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next"), allowed_hosts=None):
             return redirect(self.request.GET.get("next"))
         return redirect(self.get_order_url())
 
@@ -310,7 +310,7 @@ class OrderRefundProcess(OrderView):
             messages.success(self.request, _('The refund has been processed.'))
         else:
             messages.error(self.request, _('This refund can not be processed at the moment.'))
-        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next")):
+        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next"), allowed_hosts=None):
             return redirect(self.request.GET.get("next"))
         return redirect(self.get_order_url())
 
@@ -336,7 +336,7 @@ class OrderRefundDone(OrderView):
             messages.success(self.request, _('The refund has been marked as done.'))
         else:
             messages.error(self.request, _('This refund can not be processed at the moment.'))
-        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next")):
+        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next"), allowed_hosts=None):
             return redirect(self.request.GET.get("next"))
         return redirect(self.get_order_url())
 
diff --git a/src/pretix/control/views/organizer.py b/src/pretix/control/views/organizer.py
index c8c07969ee..8cc01ef635 100644
--- a/src/pretix/control/views/organizer.py
+++ b/src/pretix/control/views/organizer.py
@@ -2,11 +2,11 @@ from django import forms
 from django.contrib import messages
 from django.core.exceptions import PermissionDenied
 from django.core.files import File
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import Count
 from django.forms import inlineformset_factory
 from django.shortcuts import get_object_or_404, redirect
+from django.urls import reverse
 from django.utils.functional import cached_property
 from django.utils.translation import ugettext_lazy as _
 from django.views.generic import (
diff --git a/src/pretix/control/views/subevents.py b/src/pretix/control/views/subevents.py
index a7924049e2..be98112d42 100644
--- a/src/pretix/control/views/subevents.py
+++ b/src/pretix/control/views/subevents.py
@@ -3,13 +3,13 @@ from datetime import datetime
 
 from dateutil.rrule import DAILY, MONTHLY, WEEKLY, YEARLY, rrule, rruleset
 from django.contrib import messages
-from django.core.urlresolvers import reverse
 from django.db import transaction
 from django.db.models import F, IntegerField, OuterRef, Prefetch, Subquery, Sum
 from django.db.models.functions import Coalesce
 from django.forms import inlineformset_factory
 from django.http import Http404, HttpResponseRedirect
 from django.shortcuts import redirect, render
+from django.urls import reverse
 from django.utils.functional import cached_property
 from django.utils.timezone import make_aware
 from django.utils.translation import pgettext_lazy, ugettext_lazy as _
@@ -424,7 +424,7 @@ class SubEventCreate(SubEventEditorMixin, EventPermissionRequiredMixin, CreateVi
         kwargs = super().get_form_kwargs()
         kwargs['event'] = self.request.event
         if self.copy_from:
-            i = copy.copy(self.copy_from)
+            i = copy.deepcopy(self.copy_from)
             i.pk = None
             kwargs['instance'] = i
         else:
diff --git a/src/pretix/control/views/user.py b/src/pretix/control/views/user.py
index a1d1066b4c..ab92692c76 100644
--- a/src/pretix/control/views/user.py
+++ b/src/pretix/control/views/user.py
@@ -7,8 +7,8 @@ from urllib.parse import quote
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import update_session_auth_hash
-from django.core.urlresolvers import reverse
 from django.shortcuts import get_object_or_404, redirect
+from django.urls import reverse
 from django.utils.crypto import get_random_string
 from django.utils.functional import cached_property
 from django.utils.http import is_safe_url
@@ -73,7 +73,7 @@ class ReauthView(TemplateView):
             t = int(time.time())
             request.session['pretix_auth_login_time'] = t
             request.session['pretix_auth_last_used'] = t
-            if "next" in request.GET and is_safe_url(request.GET.get("next")):
+            if "next" in request.GET and is_safe_url(request.GET.get("next"), allowed_hosts=None):
                 return redirect(request.GET.get("next"))
             return redirect(reverse('control:index'))
         else:
@@ -544,7 +544,7 @@ class StartStaffSession(StaffMemberRequiredMixin, RecentAuthenticationRequiredMi
                 session_key=request.session.session_key
             )
 
-        if "next" in request.GET and is_safe_url(request.GET.get("next")):
+        if "next" in request.GET and is_safe_url(request.GET.get("next"), allowed_hosts=None):
             return redirect(request.GET.get("next"))
         else:
             return redirect(reverse("control:index"))
diff --git a/src/pretix/control/views/users.py b/src/pretix/control/views/users.py
index 757cc40947..e16682e6d9 100644
--- a/src/pretix/control/views/users.py
+++ b/src/pretix/control/views/users.py
@@ -1,13 +1,16 @@
 from django.conf import settings
 from django.contrib import messages
+from django.contrib.auth import get_user_model
 from django.contrib.auth.mixins import LoginRequiredMixin
-from django.shortcuts import get_object_or_404, redirect
+from django.core.exceptions import PermissionDenied
+from django.http import HttpResponseRedirect
+from django.shortcuts import get_object_or_404, redirect, resolve_url
 from django.urls import reverse
 from django.utils.functional import cached_property
+from django.utils.http import is_safe_url
 from django.utils.translation import ugettext_lazy as _
 from django.views import View
 from django.views.generic import ListView
-from hijack.helpers import login_user, release_hijack
 
 from pretix.base.models import User
 from pretix.base.services.mail import SendMailException
@@ -161,3 +164,78 @@ class UserCreateView(AdministratorPermissionRequiredMixin, RecentAuthenticationR
     def form_valid(self, form):
         messages.success(self.request, _('The new user has been created.'))
         return super().form_valid(form)
+
+
+# TODO: COMPAT methods: Remove after https://github.com/arteria/django-hijack/pull/178 is merged
+def login_user(request, hijacked):
+    from hijack.helpers import (
+        check_hijack_authorization, get_used_backend, no_update_last_login, login,
+        hijack_started, hijack_settings
+    )
+    hijacker = request.user
+    hijack_history = [request.user._meta.pk.value_to_string(hijacker)]
+    if request.session.get('hijack_history'):
+        hijack_history = request.session['hijack_history'] + hijack_history
+
+    check_hijack_authorization(request, hijacked)
+
+    backend = get_used_backend(request)
+    hijacked.backend = "%s.%s" % (backend.__module__, backend.__class__.__name__)
+
+    with no_update_last_login():
+        # Actually log user in
+        login(request, hijacked)
+
+    hijack_started.send(
+        sender=None, request=request,
+        hijacker=hijacker, hijacked=hijacked,
+        # send IDs for backward compatibility
+        hijacker_id=hijacker.pk, hijacked_id=hijacked.pk)
+    request.session['hijack_history'] = hijack_history
+    request.session['is_hijacked_user'] = True
+    request.session['display_hijack_warning'] = True
+    request.session.modified = True
+    return redirect_to_next(request, default_url=hijack_settings.HIJACK_LOGIN_REDIRECT_URL)
+
+
+def redirect_to_next(request, default_url):
+    redirect_to = request.GET.get('next', '')
+    if not is_safe_url(redirect_to, allowed_hosts=None):
+        redirect_to = default_url
+    return HttpResponseRedirect(resolve_url(redirect_to))
+
+
+def release_hijack(request):
+    from hijack.helpers import (
+        get_used_backend, no_update_last_login, login, hijack_ended, hijack_settings
+    )
+    hijack_history = request.session.get('hijack_history', False)
+
+    if not hijack_history:
+        raise PermissionDenied
+
+    hijacker = None
+    hijacked = None
+    if hijack_history:
+        hijacked = request.user
+        user_pk = hijack_history.pop()
+        hijacker = get_object_or_404(get_user_model(), pk=user_pk)
+        backend = get_used_backend(request)
+        hijacker.backend = "%s.%s" % (backend.__module__, backend.__class__.__name__)
+        with no_update_last_login():
+            login(request, hijacker)
+    if hijack_history:
+        request.session['hijack_history'] = hijack_history
+        request.session['is_hijacked_user'] = True
+        request.session['display_hijack_warning'] = True
+    else:
+        request.session.pop('hijack_history', None)
+        request.session.pop('is_hijacked_user', None)
+        request.session.pop('display_hijack_warning', None)
+    request.session.modified = True
+    hijack_ended.send(
+        sender=None, request=request,
+        hijacker=hijacker, hijacked=hijacked,
+        # send IDs for backward compatibility
+        hijacker_id=hijacker.pk, hijacked_id=hijacked.pk)
+    return redirect_to_next(request, default_url=hijack_settings.HIJACK_LOGOUT_REDIRECT_URL)
diff --git a/src/pretix/control/views/vouchers.py b/src/pretix/control/views/vouchers.py
index bd39a519d7..59bff24a76 100644
--- a/src/pretix/control/views/vouchers.py
+++ b/src/pretix/control/views/vouchers.py
@@ -3,7 +3,6 @@ import io
 from defusedcsv import csv
 from django.conf import settings
 from django.contrib import messages
-from django.core.urlresolvers import resolve, reverse
 from django.db import transaction
 from django.db.models import Sum
 from django.http import (
@@ -11,6 +10,7 @@ from django.http import (
     JsonResponse,
 )
 from django.shortcuts import redirect
+from django.urls import resolve, reverse
 from django.utils.functional import cached_property
 from django.utils.translation import ugettext_lazy as _
 from django.views.generic import (
diff --git a/src/pretix/helpers/urls.py b/src/pretix/helpers/urls.py
index dcc2b8092c..6113350b9d 100644
--- a/src/pretix/helpers/urls.py
+++ b/src/pretix/helpers/urls.py
@@ -1,7 +1,7 @@
 from urllib.parse import urljoin
 
 from django.conf import settings
-from django.core.urlresolvers import reverse
+from django.urls import reverse
 
 
 def build_absolute_uri(urlname, args=None, kwargs=None):
diff --git a/src/pretix/multidomain/__init__.py b/src/pretix/multidomain/__init__.py
index 18ee01d554..4ab7464d95 100644
--- a/src/pretix/multidomain/__init__.py
+++ b/src/pretix/multidomain/__init__.py
@@ -1,5 +1,6 @@
 from django.apps import AppConfig
-from django.urls import RegexURLPattern
+from django.urls import URLPattern
+from django.urls.resolvers import RegexPattern
 
 
 class PretixMultidomainConfig(AppConfig):
@@ -10,10 +11,9 @@ class PretixMultidomainConfig(AppConfig):
 default_app_config = 'pretix.multidomain.PretixMultidomainConfig'
 
 
-def event_url(regex, view, kwargs=None, name=None, require_live=True):
+def event_url(route, view, name=None, require_live=True):
     if callable(view):
-        r = RegexURLPattern(regex, view, kwargs, name)
-        r._require_live = require_live
-        return r
-    else:
-        raise TypeError('view must be a callable.')
+        pattern = RegexPattern(route, name=name, is_endpoint=True)
+        pattern._require_live = require_live
+        return URLPattern(pattern, view, {}, name)
+    raise TypeError('view must be a callable.')
diff --git a/src/pretix/multidomain/middlewares.py b/src/pretix/multidomain/middlewares.py
index e3979cbbf6..f8e9be60c6 100644
--- a/src/pretix/multidomain/middlewares.py
+++ b/src/pretix/multidomain/middlewares.py
@@ -7,9 +7,9 @@ from django.contrib.sessions.middleware import (
 )
 from django.core.cache import cache
 from django.core.exceptions import DisallowedHost
-from django.core.urlresolvers import set_urlconf
 from django.http.request import split_domain_port
 from django.middleware.csrf import CsrfViewMiddleware as BaseCsrfMiddleware
+from django.urls import set_urlconf
 from django.utils.cache import patch_vary_headers
 from django.utils.deprecation import MiddlewareMixin
 from django.utils.http import cookie_date
diff --git a/src/pretix/multidomain/models.py b/src/pretix/multidomain/models.py
index 20247b6429..dc8eb0baea 100644
--- a/src/pretix/multidomain/models.py
+++ b/src/pretix/multidomain/models.py
@@ -7,7 +7,7 @@ from pretix.base.models import Organizer
 
 class KnownDomain(models.Model):
     domainname = models.CharField(max_length=255, primary_key=True)
-    organizer = models.ForeignKey(Organizer, blank=True, null=True, related_name='domains')
+    organizer = models.ForeignKey(Organizer, blank=True, null=True, related_name='domains', on_delete=models.CASCADE)
 
     class Meta:
         verbose_name = _("Known domain")
diff --git a/src/pretix/multidomain/plugin_handler.py b/src/pretix/multidomain/plugin_handler.py
index 82db4e2a88..e58dc4b84f 100644
--- a/src/pretix/multidomain/plugin_handler.py
+++ b/src/pretix/multidomain/plugin_handler.py
@@ -7,5 +7,5 @@ def plugin_event_urls(urllist, plugin):
             plugin_event_urls(entry.url_patterns, plugin)
         elif hasattr(entry, 'callback'):
             entry.callback = _event_view(entry.callback, require_plugin=plugin,
-                                         require_live=getattr(entry, '_require_live', True))
+                                         require_live=getattr(entry.pattern, '_require_live', True))
     return urllist
diff --git a/src/pretix/multidomain/templatetags/eventurl.py b/src/pretix/multidomain/templatetags/eventurl.py
index 47203909b6..8ac978652f 100644
--- a/src/pretix/multidomain/templatetags/eventurl.py
+++ b/src/pretix/multidomain/templatetags/eventurl.py
@@ -1,8 +1,8 @@
 from django import template
-from django.core.urlresolvers import NoReverseMatch
 from django.template import TemplateSyntaxError
 from django.template.base import kwarg_re
 from django.template.defaulttags import URLNode
+from django.urls import NoReverseMatch
 from django.utils.encoding import smart_text
 from django.utils.html import conditional_escape
 
diff --git a/src/pretix/multidomain/urlreverse.py b/src/pretix/multidomain/urlreverse.py
index 12be968739..c098c21d6e 100644
--- a/src/pretix/multidomain/urlreverse.py
+++ b/src/pretix/multidomain/urlreverse.py
@@ -1,7 +1,7 @@
 from urllib.parse import urljoin, urlsplit
 
 from django.conf import settings
-from django.core.urlresolvers import reverse
+from django.urls import reverse
 
 from pretix.base.models import Event, Organizer
 
diff --git a/src/pretix/plugins/banktransfer/api.py b/src/pretix/plugins/banktransfer/api.py
index ac7991c4e3..e3e02de52d 100644
--- a/src/pretix/plugins/banktransfer/api.py
+++ b/src/pretix/plugins/banktransfer/api.py
@@ -47,7 +47,7 @@ class BankImportJobSerializer(serializers.ModelSerializer):
 
 
 class JobFilter(FilterSet):
-    event = django_filters.CharFilter(name='event', lookup_expr='slug')
+    event = django_filters.CharFilter(field_name='event', lookup_expr='slug')
 
     class Meta:
         model = BankImportJob
@@ -58,7 +58,7 @@ class BankImportJobViewSet(CreateModelMixin, viewsets.ReadOnlyModelViewSet):
     serializer_class = BankImportJobSerializer
     queryset = BankImportJob.objects.none()
     filter_backends = (DjangoFilterBackend,)
-    filter_class = JobFilter
+    filterset_class = JobFilter
     permission = 'can_view_orders'
 
     def get_queryset(self):
diff --git a/src/pretix/plugins/banktransfer/models.py b/src/pretix/plugins/banktransfer/models.py
index ee12af0aa7..ed1b239ae2 100644
--- a/src/pretix/plugins/banktransfer/models.py
+++ b/src/pretix/plugins/banktransfer/models.py
@@ -16,8 +16,8 @@ class BankImportJob(models.Model):
         (STATE_COMPLETED, 'completed'),
     )
 
-    event = models.ForeignKey('pretixbase.Event', null=True)
-    organizer = models.ForeignKey('pretixbase.Organizer', null=True)
+    event = models.ForeignKey('pretixbase.Event', null=True, on_delete=models.CASCADE)
+    organizer = models.ForeignKey('pretixbase.Organizer', null=True, on_delete=models.CASCADE)
     created = models.DateTimeField(auto_now_add=True)
     state = models.CharField(max_length=32, choices=STATES, default=STATE_PENDING)
 
@@ -48,9 +48,9 @@ class BankTransaction(models.Model):
         (STATE_DISCARDED, 'manually discarded'),
     )
 
-    event = models.ForeignKey('pretixbase.Event', null=True)
-    organizer = models.ForeignKey('pretixbase.Organizer', null=True)
-    import_job = models.ForeignKey('BankImportJob', related_name='transactions')
+    event = models.ForeignKey('pretixbase.Event', null=True, on_delete=models.CASCADE)
+    organizer = models.ForeignKey('pretixbase.Organizer', null=True, on_delete=models.CASCADE)
+    import_job = models.ForeignKey('BankImportJob', related_name='transactions', on_delete=models.CASCADE)
     state = models.CharField(max_length=32, choices=STATES, default=STATE_UNCHECKED)
     message = models.TextField()
     checksum = models.CharField(max_length=190, db_index=True)
@@ -58,7 +58,7 @@ class BankTransaction(models.Model):
     reference = models.TextField(blank=True)
     amount = models.DecimalField(max_digits=10, decimal_places=2)
     date = models.CharField(max_length=50)
-    order = models.ForeignKey('pretixbase.Order', null=True, blank=True)
+    order = models.ForeignKey('pretixbase.Order', null=True, blank=True, on_delete=models.CASCADE)
     comment = models.TextField(blank=True)
 
     def calculate_checksum(self):
diff --git a/src/pretix/plugins/banktransfer/signals.py b/src/pretix/plugins/banktransfer/signals.py
index fcf9946757..1eaab52cf5 100644
--- a/src/pretix/plugins/banktransfer/signals.py
+++ b/src/pretix/plugins/banktransfer/signals.py
@@ -1,6 +1,6 @@
-from django.core.urlresolvers import resolve, reverse
 from django.dispatch import receiver
 from django.template.loader import get_template
+from django.urls import resolve, reverse
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.signals import register_payment_providers
diff --git a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/control_head.html b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/control_head.html
index 2c7c881271..9bcde7fa20 100644
--- a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/control_head.html
+++ b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/control_head.html
@@ -1,4 +1,4 @@
-{% load staticfiles %}
+{% load static %}
 {% load compress %}
 
 {% compress css %}
diff --git a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/job_detail.html b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/job_detail.html
index 00b86c9ab3..627a64be38 100644
--- a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/job_detail.html
+++ b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/job_detail.html
@@ -1,6 +1,6 @@
 {% extends basetpl %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% block inner %}
     <h2>{% trans "Import result" %}</h2>
     {% if job.state == "running" or job.state == "pending" %}
diff --git a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/transaction_list.html b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/transaction_list.html
index 9db62d3a60..1e2d2cd155 100644
--- a/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/transaction_list.html
+++ b/src/pretix/plugins/banktransfer/templates/pretixplugins/banktransfer/transaction_list.html
@@ -1,7 +1,7 @@
 {% load i18n %}
 {% load rich_text %}
 {% load money %}
-{% load staticfiles %}
+{% load static %}
 <div class="table-responsive">
     {% csrf_token %}
     <table class="table table-condensed transaction-list" data-url="{% if request.event %}{% url "plugins:banktransfer:import.action" event=request.event.slug organizer=request.organizer.slug %}{% else %}{% url "plugins:banktransfer:import.action" organizer=request.organizer.slug %}{% endif %}">
diff --git a/src/pretix/plugins/banktransfer/views.py b/src/pretix/plugins/banktransfer/views.py
index 85a5572727..aa4c7c4167 100644
--- a/src/pretix/plugins/banktransfer/views.py
+++ b/src/pretix/plugins/banktransfer/views.py
@@ -4,11 +4,11 @@ import logging
 from datetime import timedelta
 
 from django.contrib import messages
-from django.core.urlresolvers import reverse
 from django.db.models import Count, Q
 from django.db.models.functions import Concat
 from django.http import JsonResponse
 from django.shortcuts import get_object_or_404, redirect, render
+from django.urls import reverse
 from django.utils.functional import cached_property
 from django.utils.timezone import now
 from django.utils.translation import ugettext as _
diff --git a/src/pretix/plugins/paypal/models.py b/src/pretix/plugins/paypal/models.py
index 0470a1a07b..75085dc5ab 100644
--- a/src/pretix/plugins/paypal/models.py
+++ b/src/pretix/plugins/paypal/models.py
@@ -3,5 +3,5 @@ from django.db import models
 
 class ReferencedPayPalObject(models.Model):
     reference = models.CharField(max_length=190, db_index=True, unique=True)
-    order = models.ForeignKey('pretixbase.Order')
-    payment = models.ForeignKey('pretixbase.OrderPayment', null=True, blank=True)
+    order = models.ForeignKey('pretixbase.Order', on_delete=models.CASCADE)
+    payment = models.ForeignKey('pretixbase.OrderPayment', null=True, blank=True, on_delete=models.CASCADE)
diff --git a/src/pretix/plugins/paypal/templates/pretixplugins/paypal/redirect.html b/src/pretix/plugins/paypal/templates/pretixplugins/paypal/redirect.html
index 01c9d1ae9d..2b7ff2984d 100644
--- a/src/pretix/plugins/paypal/templates/pretixplugins/paypal/redirect.html
+++ b/src/pretix/plugins/paypal/templates/pretixplugins/paypal/redirect.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/plugins/pretixdroid/models.py b/src/pretix/plugins/pretixdroid/models.py
index 10824f8357..15239ae02f 100644
--- a/src/pretix/plugins/pretixdroid/models.py
+++ b/src/pretix/plugins/pretixdroid/models.py
@@ -6,7 +6,7 @@ from django.utils.translation import ugettext_lazy as _
 
 
 class AppConfiguration(models.Model):
-    event = models.ForeignKey('pretixbase.Event')
+    event = models.ForeignKey('pretixbase.Event', on_delete=models.CASCADE)
     key = models.CharField(max_length=190, db_index=True)
     all_items = models.BooleanField(default=True, verbose_name=_('Can scan all products'))
     items = models.ManyToManyField('pretixbase.Item', blank=True, verbose_name=_('Can scan these products'))
diff --git a/src/pretix/plugins/pretixdroid/signals.py b/src/pretix/plugins/pretixdroid/signals.py
index 3a0f4db6a0..7f4a8746c9 100644
--- a/src/pretix/plugins/pretixdroid/signals.py
+++ b/src/pretix/plugins/pretixdroid/signals.py
@@ -1,6 +1,6 @@
 
-from django.core.urlresolvers import resolve, reverse
 from django.dispatch import receiver
+from django.urls import resolve, reverse
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.signals import logentry_display
diff --git a/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration.html b/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration.html
index f59ca2f0ac..bee4b32939 100644
--- a/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration.html
+++ b/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/event/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% block title %}{% trans "Check-in device configuration" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Check-in device configuration" %}</h1>
diff --git a/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration_code.html b/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration_code.html
index 7438f94895..bbdc034b15 100644
--- a/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration_code.html
+++ b/src/pretix/plugins/pretixdroid/templates/pretixplugins/pretixdroid/configuration_code.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/event/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
-{% load staticfiles %}
+{% load static %}
 {% block title %}{% trans "Device configuration" %}{% endblock %}
 {% block content %}
     {% if config.app == "pretixdroid" %}
diff --git a/src/pretix/plugins/sendmail/signals.py b/src/pretix/plugins/sendmail/signals.py
index f35d799f53..6f665e4991 100644
--- a/src/pretix/plugins/sendmail/signals.py
+++ b/src/pretix/plugins/sendmail/signals.py
@@ -1,5 +1,5 @@
-from django.core.urlresolvers import resolve, reverse
 from django.dispatch import receiver
+from django.urls import resolve, reverse
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.signals import logentry_display
diff --git a/src/pretix/plugins/statistics/signals.py b/src/pretix/plugins/statistics/signals.py
index a08edf1f5e..384405c56e 100644
--- a/src/pretix/plugins/statistics/signals.py
+++ b/src/pretix/plugins/statistics/signals.py
@@ -1,5 +1,5 @@
-from django.core.urlresolvers import resolve, reverse
 from django.dispatch import receiver
+from django.urls import resolve, reverse
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.signals import order_paid, order_placed
diff --git a/src/pretix/plugins/statistics/templates/pretixplugins/statistics/index.html b/src/pretix/plugins/statistics/templates/pretixplugins/statistics/index.html
index 0cab4bc18c..ef4a570660 100644
--- a/src/pretix/plugins/statistics/templates/pretixplugins/statistics/index.html
+++ b/src/pretix/plugins/statistics/templates/pretixplugins/statistics/index.html
@@ -1,7 +1,7 @@
 {% extends "pretixcontrol/event/base.html" %}
 {% load i18n %}
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 {% load escapejson %}
 {% block title %}{% trans "Statistics" %}{% endblock %}
 {% block content %}
diff --git a/src/pretix/plugins/stripe/models.py b/src/pretix/plugins/stripe/models.py
index a192dda5aa..9ebdc32d69 100644
--- a/src/pretix/plugins/stripe/models.py
+++ b/src/pretix/plugins/stripe/models.py
@@ -3,5 +3,5 @@ from django.db import models
 
 class ReferencedStripeObject(models.Model):
     reference = models.CharField(max_length=190, db_index=True, unique=True)
-    order = models.ForeignKey('pretixbase.Order')
-    payment = models.ForeignKey('pretixbase.OrderPayment', null=True, blank=True)
+    order = models.ForeignKey('pretixbase.Order', on_delete=models.CASCADE)
+    payment = models.ForeignKey('pretixbase.OrderPayment', null=True, blank=True, on_delete=models.CASCADE)
diff --git a/src/pretix/plugins/stripe/signals.py b/src/pretix/plugins/stripe/signals.py
index 7e16415b0d..320d4580cb 100644
--- a/src/pretix/plugins/stripe/signals.py
+++ b/src/pretix/plugins/stripe/signals.py
@@ -2,9 +2,9 @@ import json
 from collections import OrderedDict
 
 from django import forms
-from django.core.urlresolvers import resolve
 from django.dispatch import receiver
 from django.template.loader import get_template
+from django.urls import resolve
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.settings import settings_hierarkey
diff --git a/src/pretix/plugins/stripe/templates/pretixplugins/stripe/presale_head.html b/src/pretix/plugins/stripe/templates/pretixplugins/stripe/presale_head.html
index af4c0808c1..07430fef00 100644
--- a/src/pretix/plugins/stripe/templates/pretixplugins/stripe/presale_head.html
+++ b/src/pretix/plugins/stripe/templates/pretixplugins/stripe/presale_head.html
@@ -1,4 +1,4 @@
-{% load staticfiles %}
+{% load static %}
 {% load compress %}
 {% load i18n %}
 
diff --git a/src/pretix/plugins/stripe/templates/pretixplugins/stripe/redirect.html b/src/pretix/plugins/stripe/templates/pretixplugins/stripe/redirect.html
index 01c9d1ae9d..2b7ff2984d 100644
--- a/src/pretix/plugins/stripe/templates/pretixplugins/stripe/redirect.html
+++ b/src/pretix/plugins/stripe/templates/pretixplugins/stripe/redirect.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/presale/forms/checkout.py b/src/pretix/presale/forms/checkout.py
index 230de222b6..0d2d3b8825 100644
--- a/src/pretix/presale/forms/checkout.py
+++ b/src/pretix/presale/forms/checkout.py
@@ -138,6 +138,7 @@ class AddOnsForm(forms.Form):
         if override_price:
             price = override_price
 
+        print(price, repr(price), type(price), repr(item.default_price))
         if self.price_included:
             price = TAXED_ZERO
         else:
diff --git a/src/pretix/presale/middleware.py b/src/pretix/presale/middleware.py
index 15509e897d..48af185237 100644
--- a/src/pretix/presale/middleware.py
+++ b/src/pretix/presale/middleware.py
@@ -1,4 +1,4 @@
-from django.core.urlresolvers import resolve
+from django.urls import resolve
 from django.utils.deprecation import MiddlewareMixin
 
 from pretix.presale.signals import process_response
diff --git a/src/pretix/presale/templates/pretixpresale/base.html b/src/pretix/presale/templates/pretixpresale/base.html
index 149f77ff59..67c055b49c 100644
--- a/src/pretix/presale/templates/pretixpresale/base.html
+++ b/src/pretix/presale/templates/pretixpresale/base.html
@@ -1,5 +1,5 @@
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 {% load i18n %}
 {% load safelink %}
 {% load statici18n %}
diff --git a/src/pretix/presale/templates/pretixpresale/event/base.html b/src/pretix/presale/templates/pretixpresale/event/base.html
index cac2b53570..0337b699b5 100644
--- a/src/pretix/presale/templates/pretixpresale/event/base.html
+++ b/src/pretix/presale/templates/pretixpresale/event/base.html
@@ -1,6 +1,6 @@
 {% extends "pretixpresale/base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load thumb %}
 {% load eventurl %}
 {% load safelink %}
diff --git a/src/pretix/presale/templates/pretixpresale/index.html b/src/pretix/presale/templates/pretixpresale/index.html
index ebd713eca7..c308484ae2 100644
--- a/src/pretix/presale/templates/pretixpresale/index.html
+++ b/src/pretix/presale/templates/pretixpresale/index.html
@@ -1,6 +1,6 @@
 {% load i18n %}
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/presale/templates/pretixpresale/organizers/base.html b/src/pretix/presale/templates/pretixpresale/organizers/base.html
index e335d8b2f2..328aebc2c6 100644
--- a/src/pretix/presale/templates/pretixpresale/organizers/base.html
+++ b/src/pretix/presale/templates/pretixpresale/organizers/base.html
@@ -1,6 +1,6 @@
 {% extends "pretixpresale/base.html" %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 {% load thumb %}
 {% load eventurl %}
 {% block thetitle %}
diff --git a/src/pretix/presale/templates/pretixpresale/waiting.html b/src/pretix/presale/templates/pretixpresale/waiting.html
index ebd785c2f8..bfe0c758ca 100644
--- a/src/pretix/presale/templates/pretixpresale/waiting.html
+++ b/src/pretix/presale/templates/pretixpresale/waiting.html
@@ -1,6 +1,6 @@
 {% load compress %}
 {% load i18n %}
-{% load staticfiles %}
+{% load static %}
 <!DOCTYPE html>
 <html>
 <head>
diff --git a/src/pretix/presale/templates/pretixpresale/widget_dummy.html b/src/pretix/presale/templates/pretixpresale/widget_dummy.html
index 6eefdc801e..63ace3c193 100644
--- a/src/pretix/presale/templates/pretixpresale/widget_dummy.html
+++ b/src/pretix/presale/templates/pretixpresale/widget_dummy.html
@@ -1,5 +1,5 @@
 {% load compress %}
-{% load staticfiles %}
+{% load static %}
 {% compress css %}
     <link rel="stylesheet" type="text/x-scss" href="{% static "pretixpresale/scss/widget.scss" %}"/>
 {% endcompress %}
diff --git a/src/pretix/presale/utils.py b/src/pretix/presale/utils.py
index 77aac6102f..bea37a1d38 100644
--- a/src/pretix/presale/utils.py
+++ b/src/pretix/presale/utils.py
@@ -4,9 +4,9 @@ from urllib.parse import urljoin
 
 from django.conf import settings
 from django.core.exceptions import PermissionDenied
-from django.core.urlresolvers import resolve
 from django.http import Http404
 from django.shortcuts import redirect
+from django.urls import resolve
 from django.utils.translation import ugettext_lazy as _
 
 from pretix.base.middleware import LocaleMiddleware
diff --git a/src/pretix/presale/views/cart.py b/src/pretix/presale/views/cart.py
index 19b4f4ccb5..ccd92cd53c 100644
--- a/src/pretix/presale/views/cart.py
+++ b/src/pretix/presale/views/cart.py
@@ -36,7 +36,7 @@ from pretix.presale.views.robots import NoSearchIndexViewMixin
 class CartActionMixin:
 
     def get_next_url(self):
-        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next")):
+        if "next" in self.request.GET and is_safe_url(self.request.GET.get("next"), allowed_hosts=None):
             u = self.request.GET.get('next')
         else:
             kwargs = {}
diff --git a/src/pretix/presale/views/locale.py b/src/pretix/presale/views/locale.py
index 4914e8776c..e37c24599e 100644
--- a/src/pretix/presale/views/locale.py
+++ b/src/pretix/presale/views/locale.py
@@ -12,7 +12,7 @@ class LocaleSet(NoSearchIndexViewMixin, View):
 
     def get(self, request, *args, **kwargs):
         url = request.GET.get('next', request.META.get('HTTP_REFERER', '/'))
-        url = url if is_safe_url(url, host=request.get_host()) else '/'
+        url = url if is_safe_url(url, allowed_hosts=[request.get_host()]) else '/'
         resp = HttpResponseRedirect(url)
 
         locale = request.GET.get('locale')
diff --git a/src/pretix/presale/views/widget.py b/src/pretix/presale/views/widget.py
index f84ad5575f..69377cb562 100644
--- a/src/pretix/presale/views/widget.py
+++ b/src/pretix/presale/views/widget.py
@@ -14,11 +14,12 @@ from django.template.loader import get_template
 from django.utils.formats import date_format
 from django.utils.timezone import now
 from django.utils.translation import gettext
+from django.utils.translation.trans_real import DjangoTranslation
 from django.views import View
 from django.views.decorators.cache import cache_page
 from django.views.decorators.http import condition
 from django.views.i18n import (
-    get_formats, get_javascript_catalog, js_catalog_template,
+    JavaScriptCatalog, get_formats, js_catalog_template,
 )
 from lxml import etree
 
@@ -73,7 +74,10 @@ def generate_widget_js(lang):
         code.append('var module = {}, exports = {};\n')
         code.append('var lang = "%s";\n' % lang)
 
-        catalog, plural = get_javascript_catalog(lang, 'djangojs', ['pretix'])
+        c = JavaScriptCatalog()
+        c.translation = DjangoTranslation(lang, domain='djangojs')
+        catalog, plural = c.get_catalog(), c.get_plural()
+
         catalog = dict((k, v) for k, v in catalog.items() if k.startswith('widget\u0004'))
         template = Engine().from_string(js_catalog_template)
         context = Context({
diff --git a/src/pretix/settings.py b/src/pretix/settings.py
index 3800460fd3..66da306a9d 100644
--- a/src/pretix/settings.py
+++ b/src/pretix/settings.py
@@ -272,6 +272,7 @@ REST_FRAMEWORK = {
     'DEFAULT_PERMISSION_CLASSES': [
         'pretix.api.auth.permission.EventPermission',
     ],
+    'DEFAULT_PAGINATION_CLASS': 'rest_framework.pagination.PageNumberPagination',
     'DEFAULT_VERSIONING_CLASS': 'rest_framework.versioning.NamespaceVersioning',
     'PAGE_SIZE': 50,
     'DEFAULT_AUTHENTICATION_CLASSES': (
@@ -300,7 +301,6 @@ MIDDLEWARE = [
     'pretix.multidomain.middlewares.SessionMiddleware',
     'pretix.multidomain.middlewares.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
-    'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'pretix.control.middleware.PermissionMiddleware',
diff --git a/src/pretix/static/jsi18n/en/djangojs.js b/src/pretix/static/jsi18n/en/djangojs.js
index 3a315fda09..8b7336b13b 100644
--- a/src/pretix/static/jsi18n/en/djangojs.js
+++ b/src/pretix/static/jsi18n/en/djangojs.js
@@ -84,9 +84,9 @@
       "%m/%d/%y"
     ],
     "DECIMAL_SEPARATOR": ".",
-    "FIRST_DAY_OF_WEEK": "0",
+    "FIRST_DAY_OF_WEEK": 0,
     "MONTH_DAY_FORMAT": "F j",
-    "NUMBER_GROUPING": "3",
+    "NUMBER_GROUPING": 3,
     "SHORT_DATETIME_FORMAT": "Y-m-d H:i",
     "SHORT_DATE_FORMAT": "Y-m-d",
     "THOUSAND_SEPARATOR": ",",
diff --git a/src/pretix/urls.py b/src/pretix/urls.py
index e54741604e..2dbabd01a1 100644
--- a/src/pretix/urls.py
+++ b/src/pretix/urls.py
@@ -17,7 +17,7 @@ base_patterns = [
     url(r'^metrics$', metrics.serve_metrics,
         name='metrics'),
     url(r'^csp_report/$', csp.csp_report, name='csp.report'),
-    url(r'^api/v1/', include('pretix.api.urls', namespace='api-v1')),
+    url(r'^api/v1/', include(('pretix.api.urls', 'pretixapi'), namespace='api-v1')),
     url(r'^api/$', RedirectView.as_view(url='/api/v1/'), name='redirect-api-version')
 ]
 
diff --git a/src/requirements/dev.txt b/src/requirements/dev.txt
index 09aafe5505..ac01b422a9 100644
--- a/src/requirements/dev.txt
+++ b/src/requirements/dev.txt
@@ -1,4 +1,4 @@
-django-debug-toolbar==1.8
+django-debug-toolbar==1.9.1
 sqlparse==0.2.1  # pinned due to difficulties with django-debug-toolbar
 # Testing requirements
 pep8==1.5.7  # exact requirement by flake8 2.4.0
@@ -10,8 +10,8 @@ coverage
 pytest==3.6.*
 pytest-django
 isort
-pytest-mock==1.4.*
 pytest-rerunfailures==4.*
+pytest-mock==1.6.*
 pytest-cache
 pytest-sugar
 responses
diff --git a/src/requirements/production.txt b/src/requirements/production.txt
index 3a731fdfa2..3fd0869aec 100644
--- a/src/requirements/production.txt
+++ b/src/requirements/production.txt
@@ -1,29 +1,29 @@
 # Functional requirements
-Django==1.11.*
-djangorestframework==3.6.*
+Django>=2.1,<2.2
+djangorestframework==3.8.*
 python-dateutil
 pytz
-django-bootstrap3==8.2.*
+django-bootstrap3==10.0.*
 django-formset-js-improved==0.5.0.2
-django-compressor==2.1.1
+django-compressor==2.2.*
 django-hierarkey==1.0.*,>=1.0.3
-django-filter==1.0.*
-reportlab==3.4.*
+django-filter==2.0.*
+reportlab==3.5.*
 PyPDF2==1.26.*
 Pillow
 django-libsass
 libsass
-django-otp==0.3.*
+django-otp==0.4.*
 python-u2flib-server==4.*
-django-formtools==2.0
+django-formtools==2.1
 celery>=4.1.1,<4.2.0
 kombu==4.2.*
-django-statici18n==1.3.*
+django-statici18n==1.8.*
 inlinestyler==0.2.*
 BeautifulSoup4
 slimit
 lxml
-static3==0.6.1
+static3==0.7.*
 dj-static
 csscompressor
 django-markup
@@ -31,13 +31,13 @@ markdown
 bleach==2.*
 raven
 babel
-django-i18nfield>=1.2.1
+django-i18nfield>=1.4.0
 django-hijack==2.1.*
-django-oauth-toolkit==1.1.*
+django-oauth-toolkit==1.2.*
 # Stripe
 stripe==2.0.*
 # PayPal
-paypalrestsdk==1.12.*
+paypalrestsdk==1.13.*
 pycparser==2.13  # https://github.com/eliben/pycparser/issues/147
 # Banktransfer
 chardet<3.1.0,>=3.0.2
diff --git a/src/requirements/py34.txt b/src/requirements/py34.txt
deleted file mode 100644
index c997f364b4..0000000000
--- a/src/requirements/py34.txt
+++ /dev/null
@@ -1 +0,0 @@
-typing
diff --git a/src/setup.py b/src/setup.py
index b4e85e7390..c8f8b7c87a 100644
--- a/src/setup.py
+++ b/src/setup.py
@@ -1,4 +1,5 @@
 import os
+import sys
 from codecs import open
 from distutils.command.build import build
 from os import path
@@ -7,6 +8,27 @@ from setuptools import find_packages, setup
 
 from pretix import __version__
 
+CURRENT_PYTHON = sys.version_info[:2]
+REQUIRED_PYTHON = (3, 5)
+if CURRENT_PYTHON < REQUIRED_PYTHON:
+    sys.stderr.write("""
+==========================
+Unsupported Python version
+==========================
+This version of pretix requires Python {}.{}, but you're trying to
+install it on Python {}.{}.
+This may be because you are using a version of pip that doesn't
+understand the python_requires classifier. Make sure you
+have pip >= 9.0 and setuptools >= 24.2, then try again:
+    $ python -m pip install --upgrade pip setuptools
+    $ python -m pip install pretix
+This will install the latest version of pretix which works on your
+version of Python. If you can't upgrade your pip (or Python), request
+an older version of pretix:
+    $ python -m pip install "pretix<2"
+""".format(*(REQUIRED_PYTHON + CURRENT_PYTHON)))
+    sys.exit(1)
+
 here = path.abspath(path.dirname(__file__))
 
 # Get the long description from the relevant file
@@ -43,6 +65,7 @@ cmdclass = {
 setup(
     name='pretix',
     version=__version__,
+    python_requires='>={}.{}'.format(*REQUIRED_PYTHON),
     description='Reinventing presales, one ticket at a time',
     long_description=long_description,
     url='https://pretix.eu',
@@ -56,39 +79,39 @@ setup(
         'Topic :: Internet :: WWW/HTTP :: Dynamic Content',
         'Environment :: Web Environment',
         'License :: OSI Approved :: Apache Software License',
-        'Programming Language :: Python :: 3.4',
         'Programming Language :: Python :: 3.5',
         'Programming Language :: Python :: 3.6',
-        'Framework :: Django :: 1.11'
+        'Programming Language :: Python :: 3.7',
+        'Framework :: Django :: 2.1'
     ],
 
     keywords='tickets web shop ecommerce',
     install_requires=[
-        'Django==1.11.*',
-        'djangorestframework==3.6.*',
+        'Django>=2.1,<2.2',
+        'djangorestframework==3.8.*',
         'python-dateutil==2.4.*',
         'pytz',
-        'django-bootstrap3==8.2.*',
+        'django-bootstrap3==10.0.*',
         'django-formset-js-improved==0.5.0.2',
-        'django-compressor==2.1',
+        'django-compressor==2.2.*',
         'django-hierarkey==1.0.*,>=1.0.2',
-        'django-filter==1.0.*',
-        'reportlab==3.4.*',
+        'django-filter==2.0.*',
+        'reportlab==3.5.*',
         'Pillow',
         'PyPDF2==1.26.*',
         'django-libsass',
         'libsass',
-        'django-otp==0.3.*',
+        'django-otp==0.4.*',
         'python-u2flib-server==4.*',
-        'django-formtools==2.0',
+        'django-formtools==2.1',
         'celery>=4.1.1,<4.2.0',
         'kombu==4.2.*',
-        'django-statici18n==1.3.*',
+        'django-statici18n==1.8.*',
         'inlinestyler==0.2.*',
         'BeautifulSoup4',
         'slimit',
         'lxml',
-        'static3==0.6.1',
+        'static3==0.7.*',
         'dj-static',
         'csscompressor',
         'django-markup',
@@ -96,14 +119,14 @@ setup(
         'bleach==2.*',
         'raven',
         'babel',
-        'paypalrestsdk==1.12.*',
+        'paypalrestsdk==1.13.*',
         'pycparser==2.13',
         'django-redis==4.7.*',
         'redis==2.10.5',
         'stripe==2.0.*',
         'chardet<3.1.0,>=3.0.2',
-        'mt-940==4.7',
-        'django-i18nfield>=1.2.1',
+        'mt-940==3.2',
+        'django-i18nfield>=1.4.0',
         'vobject==0.9.*',
         'pycountry',
         'django-countries',
@@ -111,12 +134,12 @@ setup(
         'defusedcsv',
         'vat_moss==0.11.0',
         'django-hijack==2.1.*',
-        'django-oauth-toolkit==1.1.*',
+        'django-oauth-toolkit==1.2.*',
         'idna==2.6',  # required by current requests
     ],
     extras_require={
         'dev': [
-            'django-debug-toolbar==1.7',
+            'django-debug-toolbar==1.9.1',
             'sqlparse==0.2.1',
             'pep8==1.5.7',
             'pyflakes==1.1.0',
@@ -127,7 +150,7 @@ setup(
             'pytest==3.6.*',
             'pytest-django',
             'isort',
-            'pytest-mock',
+            'pytest-mock==1.6.*',
             'pytest-rerunfailures',
             'pytest-warnings',
             'responses'
diff --git a/src/tests/api/test_auth.py b/src/tests/api/test_auth.py
index b6c6046461..19e796250b 100644
--- a/src/tests/api/test_auth.py
+++ b/src/tests/api/test_auth.py
@@ -13,6 +13,7 @@ def test_no_auth(client):
 def test_session_auth_no_teams(client, user):
     client.login(email=user.email, password='dummy')
     resp = client.get('/api/v1/organizers/')
+    print(resp.data)
     assert resp.status_code == 200
     assert len(resp.data['results']) == 0
 
@@ -20,7 +21,7 @@ def test_session_auth_no_teams(client, user):
 @pytest.mark.django_db
 def test_session_auth_with_teams(client, user, team):
     team.members.add(user)
-    Organizer.objects.create(name='Other dummy', slug='dummy')
+    Organizer.objects.create(name='Other dummy', slug='dummy2')
     client.login(email=user.email, password='dummy')
     resp = client.get('/api/v1/organizers/')
     assert resp.status_code == 200
@@ -36,7 +37,7 @@ def test_token_invalid(client):
 
 @pytest.mark.django_db
 def test_token_auth_valid(client, team):
-    Organizer.objects.create(name='Other dummy', slug='dummy')
+    Organizer.objects.create(name='Other dummy', slug='dummy2')
     t = team.tokens.create(name='Foo')
     client.credentials(HTTP_AUTHORIZATION='Token ' + t.token)
     resp = client.get('/api/v1/organizers/')
@@ -46,7 +47,7 @@ def test_token_auth_valid(client, team):
 
 @pytest.mark.django_db
 def test_token_auth_inactive(client, team):
-    Organizer.objects.create(name='Other dummy', slug='dummy')
+    Organizer.objects.create(name='Other dummy', slug='dummy2')
     t = team.tokens.create(name='Foo', active=False)
     client.credentials(HTTP_AUTHORIZATION='Token ' + t.token)
     resp = client.get('/api/v1/organizers/')
diff --git a/src/tests/api/test_checkin.py b/src/tests/api/test_checkin.py
index 33f75fd6ac..d3fcb4c14c 100644
--- a/src/tests/api/test_checkin.py
+++ b/src/tests/api/test_checkin.py
@@ -151,8 +151,9 @@ def test_list_list(token_client, organizer, event, clist, item, subevent):
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/checkinlists/?subevent={}'.format(organizer.slug, event.slug, subevent.pk))
     assert [res] == resp.data['results']
+    se2 = event.subevents.create(name="Foobar", date_from=datetime.datetime(2017, 12, 27, 10, 0, 0, tzinfo=UTC))
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/checkinlists/?subevent={}'.format(organizer.slug, event.slug, subevent.pk + 1))
+        '/api/v1/organizers/{}/events/{}/checkinlists/?subevent={}'.format(organizer.slug, event.slug, se2.pk))
     assert [] == resp.data['results']
 
 
diff --git a/src/tests/api/test_items.py b/src/tests/api/test_items.py
index fe3d22965f..4646dd81e0 100644
--- a/src/tests/api/test_items.py
+++ b/src/tests/api/test_items.py
@@ -238,6 +238,7 @@ TEST_ITEM_RES = {
 
 @pytest.mark.django_db
 def test_item_list(token_client, organizer, event, team, item):
+    cat = event.categories.create(name="foo")
     res = dict(TEST_ITEM_RES)
     res["id"] = item.pk
     resp = token_client.get('/api/v1/organizers/{}/events/{}/items/'.format(organizer.slug, event.slug))
@@ -252,7 +253,8 @@ def test_item_list(token_client, organizer, event, team, item):
     assert resp.status_code == 200
     assert [] == resp.data['results']
 
-    resp = token_client.get('/api/v1/organizers/{}/events/{}/items/?category=1'.format(organizer.slug, event.slug))
+    resp = token_client.get('/api/v1/organizers/{}/events/{}/items/?category={}'.format(organizer.slug, event.slug,
+                                                                                        cat.pk))
     assert resp.status_code == 200
     assert [] == resp.data['results']
 
@@ -1074,8 +1076,9 @@ def test_quota_list(token_client, organizer, event, quota, item, subevent):
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/quotas/?subevent={}'.format(organizer.slug, event.slug, subevent.pk))
     assert [res] == resp.data['results']
+    se2 = event.subevents.create(name="Foobar", date_from=datetime(2017, 12, 27, 10, 0, 0, tzinfo=UTC))
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/quotas/?subevent={}'.format(organizer.slug, event.slug, subevent.pk + 1))
+        '/api/v1/organizers/{}/events/{}/quotas/?subevent={}'.format(organizer.slug, event.slug, se2.pk))
     assert [] == resp.data['results']
 
 
diff --git a/src/tests/api/test_orders.py b/src/tests/api/test_orders.py
index dbaa631008..3da3577599 100644
--- a/src/tests/api/test_orders.py
+++ b/src/tests/api/test_orders.py
@@ -535,6 +535,7 @@ def test_orderposition_list(token_client, organizer, event, order, item, subeven
     i2.pk = None
     i2.save()
     var = item.variations.create(value="Children")
+    var2 = item.variations.create(value="Children")
     res = dict(TEST_ORDERPOSITION_RES)
     op = order.positions.first()
     op.variation = var
@@ -564,14 +565,14 @@ def test_orderposition_list(token_client, organizer, event, order, item, subeven
         ))
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/orderpositions/?item={}'.format(organizer.slug, event.slug, item.pk + 1))
+        '/api/v1/organizers/{}/events/{}/orderpositions/?item={}'.format(organizer.slug, event.slug, i2.pk))
     assert [] == resp.data['results']
 
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/orderpositions/?variation={}'.format(organizer.slug, event.slug, var.pk))
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/orderpositions/?variation={}'.format(organizer.slug, event.slug, var.pk + 1))
+        '/api/v1/organizers/{}/events/{}/orderpositions/?variation={}'.format(organizer.slug, event.slug, var2.pk))
     assert [] == resp.data['results']
 
     resp = token_client.get(
diff --git a/src/tests/api/test_vouchers.py b/src/tests/api/test_vouchers.py
index be657a40a1..e97de65014 100644
--- a/src/tests/api/test_vouchers.py
+++ b/src/tests/api/test_vouchers.py
@@ -1,3 +1,4 @@
+import copy
 import datetime
 from decimal import Decimal
 
@@ -51,6 +52,13 @@ def test_voucher_list(token_client, organizer, event, voucher, item, quota, sube
     res['item'] = item.pk
     res['id'] = voucher.pk
     res['code'] = voucher.code
+    q2 = copy.copy(quota)
+    q2.pk = None
+    q2.save()
+    i2 = copy.copy(item)
+    i2.pk = None
+    i2.save()
+    var2 = i2.variations.create(value="foo")
 
     resp = token_client.get('/api/v1/organizers/{}/events/{}/vouchers/'.format(organizer.slug, event.slug))
     assert resp.status_code == 200
@@ -124,7 +132,7 @@ def test_voucher_list(token_client, organizer, event, voucher, item, quota, sube
     )
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/vouchers/?item={}'.format(organizer.slug, event.slug, item.pk + 1)
+        '/api/v1/organizers/{}/events/{}/vouchers/?item={}'.format(organizer.slug, event.slug, i2.pk)
     )
     assert [] == resp.data['results']
 
@@ -137,7 +145,7 @@ def test_voucher_list(token_client, organizer, event, voucher, item, quota, sube
     )
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/vouchers/?variation={}'.format(organizer.slug, event.slug, var.pk + 1)
+        '/api/v1/organizers/{}/events/{}/vouchers/?variation={}'.format(organizer.slug, event.slug, var2.pk)
     )
     assert [] == resp.data['results']
 
@@ -153,7 +161,7 @@ def test_voucher_list(token_client, organizer, event, voucher, item, quota, sube
     )
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/vouchers/?quota={}'.format(organizer.slug, event.slug, quota.pk + 1)
+        '/api/v1/organizers/{}/events/{}/vouchers/?quota={}'.format(organizer.slug, event.slug, q2.pk)
     )
     assert [] == resp.data['results']
 
@@ -200,9 +208,10 @@ def test_voucher_list(token_client, organizer, event, voucher, item, quota, sube
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/vouchers/?subevent={}'.format(organizer.slug, event.slug, subevent.pk))
     assert [res] == resp.data['results']
+    se2 = event.subevents.create(name="Foobar", date_from=datetime.datetime(2017, 12, 27, 10, 0, 0, tzinfo=UTC))
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/vouchers/?subevent={}'.format(organizer.slug, event.slug,
-                                                                       subevent.pk + 1))
+                                                                       se2.pk))
     assert [] == resp.data['results']
 
 
diff --git a/src/tests/api/test_waitinglist.py b/src/tests/api/test_waitinglist.py
index 89b074ee02..f51bd87058 100644
--- a/src/tests/api/test_waitinglist.py
+++ b/src/tests/api/test_waitinglist.py
@@ -1,3 +1,4 @@
+import copy
 import datetime
 from unittest import mock
 
@@ -43,9 +44,13 @@ TEST_WLE_RES = {
 @pytest.mark.django_db
 def test_wle_list(token_client, organizer, event, wle, item, subevent):
     var = item.variations.create(value="Children")
+    var2 = item.variations.create(value="Children")
     res = dict(TEST_WLE_RES)
     wle.variation = var
     wle.save()
+    i2 = copy.copy(item)
+    i2.pk = None
+    i2.save()
     res["id"] = wle.pk
     res["item"] = item.pk
     res["variation"] = var.pk
@@ -58,14 +63,14 @@ def test_wle_list(token_client, organizer, event, wle, item, subevent):
         '/api/v1/organizers/{}/events/{}/waitinglistentries/?item={}'.format(organizer.slug, event.slug, item.pk))
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/waitinglistentries/?item={}'.format(organizer.slug, event.slug, item.pk + 1))
+        '/api/v1/organizers/{}/events/{}/waitinglistentries/?item={}'.format(organizer.slug, event.slug, i2.pk))
     assert [] == resp.data['results']
 
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/waitinglistentries/?variation={}'.format(organizer.slug, event.slug, var.pk))
     assert [res] == resp.data['results']
     resp = token_client.get(
-        '/api/v1/organizers/{}/events/{}/waitinglistentries/?variation={}'.format(organizer.slug, event.slug, var.pk + 1))
+        '/api/v1/organizers/{}/events/{}/waitinglistentries/?variation={}'.format(organizer.slug, event.slug, var2.pk))
     assert [] == resp.data['results']
 
     resp = token_client.get(
@@ -106,9 +111,10 @@ def test_wle_list(token_client, organizer, event, wle, item, subevent):
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/waitinglistentries/?subevent={}'.format(organizer.slug, event.slug, subevent.pk))
     assert [res] == resp.data['results']
+    se2 = event.subevents.create(name="Foobar", date_from=datetime.datetime(2017, 12, 27, 10, 0, 0, tzinfo=UTC))
     resp = token_client.get(
         '/api/v1/organizers/{}/events/{}/waitinglistentries/?subevent={}'.format(organizer.slug, event.slug,
-                                                                                 subevent.pk + 1))
+                                                                                 se2.pk))
     assert [] == resp.data['results']
 
 
diff --git a/src/tests/base/test_models.py b/src/tests/base/test_models.py
index 970fdbc12b..56bc5cb538 100644
--- a/src/tests/base/test_models.py
+++ b/src/tests/base/test_models.py
@@ -1144,7 +1144,7 @@ class EventTest(TestCase):
         cl1.limit_products.add(i1)
 
         event2 = Event.objects.create(
-            organizer=self.organizer, name='Download', slug='ab1234',
+            organizer=self.organizer, name='Download', slug='ab54321',
             date_from=datetime.datetime(2013, 12, 26, tzinfo=datetime.timezone.utc)
         )
         event2.copy_data_from(event1)
diff --git a/src/tests/base/test_permissions.py b/src/tests/base/test_permissions.py
index c9d1e1b270..9ab39cace5 100644
--- a/src/tests/base/test_permissions.py
+++ b/src/tests/base/test_permissions.py
@@ -147,7 +147,7 @@ def test_event_permissions_multiple_teams(event, user):
     team2 = Team.objects.create(organizer=event.organizer, can_change_vouchers=True)
     team3 = Team.objects.create(organizer=event.organizer, can_change_event_settings=True)
     event2 = Event.objects.create(
-        organizer=event.organizer, name='Dummy', slug='dummy',
+        organizer=event.organizer, name='Dummy', slug='dummy2',
         date_from=now()
     )
     team1.members.add(user)
diff --git a/src/tests/control/test_events.py b/src/tests/control/test_events.py
index d5aaed83e0..3ffe0d8281 100644
--- a/src/tests/control/test_events.py
+++ b/src/tests/control/test_events.py
@@ -417,7 +417,7 @@ class EventsTest(SoupTest):
             'foundation-organizer': self.orga2.pk,
             'foundation-locales': ('en', 'de')
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
     def test_create_invalid_default_language(self):
         doc = self.post_doc('/control/events/add', {
@@ -442,7 +442,7 @@ class EventsTest(SoupTest):
             'basics-presale_start': '2016-11-01 10:00:00',
             'basics-presale_end': '2016-11-30 18:00:00',
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
     def test_create_duplicate_slug(self):
         doc = self.post_doc('/control/events/add', {
@@ -471,7 +471,7 @@ class EventsTest(SoupTest):
             'basics-presale_end_0': '2016-11-30',
             'basics-presale_end_1': '18:00:00',
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
     def test_create_event_success(self):
         doc = self.get_doc('/control/events/add')
@@ -642,7 +642,7 @@ class EventsTest(SoupTest):
             'basics-presale_end_0': '2016-11-30',
             'basics-presale_end_1': '18:00:00',
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
     def test_create_event_currency_symbol(self):
         doc = self.post_doc('/control/events/add', {
@@ -669,7 +669,7 @@ class EventsTest(SoupTest):
             'basics-presale_end_0': '2016-11-30',
             'basics-presale_end_1': '18:00:00',
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
     def test_create_event_non_iso_currency(self):
         doc = self.post_doc('/control/events/add', {
@@ -696,7 +696,7 @@ class EventsTest(SoupTest):
             'basics-presale_end_0': '2016-11-30',
             'basics-presale_end_1': '18:00:00',
         })
-        assert doc.select(".alert-danger")
+        assert doc.select(".has-error")
 
 
 class SubEventsTest(SoupTest):
diff --git a/src/tests/control/test_vouchers.py b/src/tests/control/test_vouchers.py
index fa22cca00f..d9cf9f524b 100644
--- a/src/tests/control/test_vouchers.py
+++ b/src/tests/control/test_vouchers.py
@@ -42,7 +42,7 @@ class VoucherFormTest(SoupTest):
         form_data.update(data)
         doc = self.post_doc('/control/event/%s/%s/vouchers/add' % (self.orga.slug, self.event.slug), form_data)
         if expected_failure:
-            assert doc.select(".alert-danger")
+            assert doc.select(".alert-danger, .has-error")
             assert count_before == self.event.vouchers.count()
         else:
             assert doc.select(".alert-success")
diff --git a/src/tests/helpers/test_urls.py b/src/tests/helpers/test_urls.py
index 6894a7e335..c00d842f29 100644
--- a/src/tests/helpers/test_urls.py
+++ b/src/tests/helpers/test_urls.py
@@ -1,5 +1,5 @@
+from django import urls
 from django.conf import settings
-from django.core import urlresolvers
 
 from pretix.helpers.urls import build_absolute_uri
 
@@ -11,7 +11,7 @@ def test_site_url_domain():
 
 def test_site_url_subpath():
     settings.SITE_URL = 'https://example.com/presale'
-    old_prefix = urlresolvers.get_script_prefix()
-    urlresolvers.set_script_prefix('/presale/')
+    old_prefix = urls.get_script_prefix()
+    urls.set_script_prefix('/presale/')
     assert build_absolute_uri('control:auth.login') == 'https://example.com/presale/control/login'
-    urlresolvers.set_script_prefix(old_prefix)
+    urls.set_script_prefix(old_prefix)
diff --git a/src/tests/multidomain/test_plugin_handler.py b/src/tests/multidomain/test_plugin_handler.py
new file mode 100644
index 0000000000..68a893f653
--- /dev/null
+++ b/src/tests/multidomain/test_plugin_handler.py
@@ -0,0 +1,47 @@
+import pytest
+from django.conf import settings
+from django.utils.timezone import now
+
+from pretix.base.models import Event, Organizer
+
+
+@pytest.fixture
+def event():
+    o = Organizer.objects.create(name='MRMCD', slug='mrmcd')
+    event = Event.objects.create(
+        organizer=o, name='MRMCD2015', slug='2015',
+        date_from=now(),
+    )
+    settings.SITE_URL = 'http://example.com'
+    return event
+
+
+@pytest.mark.django_db
+def test_require_plugin(event, client):
+    event.plugins = 'pretix.plugins.paypal'
+    event.live = True
+    event.save()
+    r = client.get('/mrmcd/2015/paypal/abort/', follow=False)
+    assert r.status_code == 302
+    event.plugins = ''
+    event.save()
+    r = client.get('/mrmcd/2015/paypal/abort/', follow=False)
+    assert r.status_code == 404
+
+
+@pytest.mark.django_db
+def test_require_live(event, client):
+    event.plugins = 'pretix.plugins.paypal'
+    event.live = True
+    event.save()
+    r = client.get('/mrmcd/2015/paypal/abort/', follow=False)
+    assert r.status_code == 302
+    r = client.get('/mrmcd/2015/paypal/webhook/', follow=False)
+    assert r.status_code == 405
+
+    event.live = False
+    event.save()
+    r = client.get('/mrmcd/2015/paypal/abort/', follow=False)
+    assert r.status_code == 403
+    r = client.get('/mrmcd/2015/paypal/webhook/', follow=False)
+    assert r.status_code == 405
diff --git a/src/tests/multidomain/test_templatetag.py b/src/tests/multidomain/test_templatetag.py
index da06d7b1f7..4bd4b028c5 100644
--- a/src/tests/multidomain/test_templatetag.py
+++ b/src/tests/multidomain/test_templatetag.py
@@ -1,7 +1,7 @@
 import pytest
 from django.conf import settings
-from django.core.urlresolvers import NoReverseMatch
 from django.template import Context, Template, TemplateSyntaxError
+from django.urls import NoReverseMatch
 from django.utils.timezone import now
 
 from pretix.base.models import Event, Organizer
diff --git a/src/tests/presale/test_checkout.py b/src/tests/presale/test_checkout.py
index 636de97022..8d7975d279 100644
--- a/src/tests/presale/test_checkout.py
+++ b/src/tests/presale/test_checkout.py
@@ -49,9 +49,9 @@ class CheckoutTestCase(TestCase):
         self.workshopcat = ItemCategory.objects.create(name="Workshops", is_addon=True, event=self.event)
         self.workshopquota = Quota.objects.create(event=self.event, name='Workshop 1', size=5)
         self.workshop1 = Item.objects.create(event=self.event, name='Workshop 1',
-                                             category=self.workshopcat, default_price=12)
+                                             category=self.workshopcat, default_price=Decimal('12.00'))
         self.workshop2 = Item.objects.create(event=self.event, name='Workshop 2',
-                                             category=self.workshopcat, default_price=12)
+                                             category=self.workshopcat, default_price=Decimal('12.00'))
         self.workshop2a = ItemVariation.objects.create(item=self.workshop2, value='A')
         self.workshop2b = ItemVariation.objects.create(item=self.workshop2, value='B')
         self.workshopquota.items.add(self.workshop1)