[gojomo]

If it's not a tall order on the webserver, it's not a tall order in Django either... but Django devs may find it easier to do in Python/Django, compared to translating the Django admonitions into their various local server configurations.

And even if it's easy enough to do it elsewhere, if in practice it gets overlooked and the costs of overlooking it are high, that would be a good reason to make the lazy/common path the safest path.