make sure web requests are run inside a transaction for logged-in users, because Security.check() most likely will need to access the DB
fix locale only for Web.serveContent* and not for Web.sitemap
include sitemap support by default