Set admin.protectindexpage to TRUE.

Otherwise everyone can get the EB version, installation path and some
other info from https://profile.{{openconext_url}}/simplesaml/
Not a large risk in itself, but still unexpected behaviour.