coverage: 92.832%. remained the same
when pulling 224e3e1 on sjanssen2:patch-9
into 58e15a4 on qiita-spots:dev.

Thank you @sjanssen2; if we can't confirm the list of things in your last comment would it be better to add these changes and details to the INSTALL.md document? That way is available and admins/users can decide if they need to add these changes or not.

I @antgonza, last week, I have checked the added configuration to nginx with our local admins. They couldn't find any security related misconfiguration. Thus, I would say the second point is checked, while the first one about the locations is something you can answer best.

To be honest, I don't recall having to add those lines (or anything similar) to our nginx configuration but it sounds like it worked for you and your sys-admin. Thus, I think is fine to merge. Thank you.

Seems to depend on the actual routing of the traffic. Admins told me, we are running nginx behind an HA proxy which routes external HTTPS requests internally via HTTP. In this case, the additional lines are also probably not necessary - but wouldn't hurt either.