Security

• Hardened the app against common web attacks. Added a Content-Security-Policy and companion protections (strict transport security, clickjacking and MIME-sniffing defenses) to every page, reducing the impact of any attempt to inject malicious content. This is invisible in normal use.
• Your unpublished drafts are now private. A draft argument and its claims are only readable by you (and anyone you've added) until you publish — previously an unpublished draft could be read by someone who knew its link. Claiming an imported post now requires signing in with the matching social account.