Another round of behind-the-scenes security hardening

We ran a full audit of the user-facing app and tightened several layers of browser-level defense. Everything is invisible in normal use; nothing changes in…