Fixes crash when workflow is enabled but no hostnames are configured for it.
The headers Referrer-Policy, X-Content-Type-Options and Permissions-Policy were inadvertently left off a list that allows them to be configured. The default values for the first two are now as was always intended. The third is not enabled by default but can now optionally be configured.
Fixed bug that caused errors on sites with a baseUrl setting. Declared stable.
Beta release for evaluation.