web/security: Fill in backports for recent releases