Security hardening: private caching for gated images, admin CSRF, /ready redaction