Distinguish between composer install and composer upgrade
Account for location.hash in iframe redirect
Set security-related HTTP headers in middleware