1) Switch to VAPID
https://rossta.net/blog/using-the-web-push-api-with-vapid.html
https://developers.google.com/web/updates/2016/07/web-push-interop-wins

2) Maybe defend notification_plus_one view from request forgery and add cache
to it to lower impact on DB.

3) Maybe change from CRON + management command to some hipster stuff.
