v0.17.1

Changed

• The Caddyfiles send X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin and X-Frame-Options: SAMEORIGIN, and remove the Server header.
• SVG files are served with Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox, from Caddy and from PageFiles::sendFile(). Served files carry nosniff.
• php.ini sets session.cookie_secure=1, so the session cookie is sent only over HTTPS. Local development over plain HTTP needs HTTPS or this setting turned off. It also turns off display_startup_errors, upload progress, enable_dl and cgi.fix_pathinfo, and limits max_input_time to 60 seconds.
• The Docker images no longer install pdo_pgsql.