3b69b58ba3
- set Cache-Control no-store and Vary on rewritten responses - accept only http/https X-Forwarded-Proto - reject invalid Host headers and JSON-escape the injected base URL - route remote HEAD and serve rewritten HEAD via the GET path - classify snupkg, readme and icon as immutable