More backend work today:
- Add double-submit CSRF token feature to mitigate exploits - makes it harder for third parties to trick you into doing actions with your account from hidden forms on their website
- Minor redirect and error page tweaks to look slightly less bad
- Remove some lingering ancient volatile GET requests - more conformant to modern standards
- Add recent threads to sidebar advert box that appears on various pages
- Declare all static assets to be immutable, improving caching performance - this one should improve perceived site speed by making sure your browser holds onto page assets very aggressively

There's also been some work on the chat system's backend, and the beginnings of a modern frontend for it, though this is yet to be deployed.