Add Tor to the web interface -- it must be explicitly enabled for individual samples, with a global disable available in auxiliary.conf.  Different environments can adjust accordingly, but this works best for cases where the default should be offline-only analysis to prevent leakage of sensitive information.  Also document how the start/stop scripts can be implemented securely without any additional privilege needed by Cuckoo.