Version the JS payload
Make visitors a child of installations and add current_user lockdown