Addig forgotten = in form query string
Performance and security-oriented improvements

* Tightening up initial and temp SAMEORIGIN header removal. Still not
production ready, but better.
* Trying to only run code when needed (checking SCRIPT_NAME)
In-code comment update