[gojomo]

I agree, it's not a tall order on the webserver... but that means it's not a tall order in Django either... and Django devs may find it easier to do in Python/Django, compared to translating the Django admonitions into their various local server configurations.

Even if it's easy enough to do it elsewhere, if in practice it gets overlooked, and the risks of overlooking it are high, that would be a reason to make the lazy/common path the safest path.