The dashboard works behind proxies and security plugins

Fixed

• Settings and reports stopped loading on hosts that strip custom request headers.
• A shared cache could serve an admin a signed-out page.

Improved

• Errors now say what went wrong instead of a generic message.