• support YAML arrays for the groups property of users
• Fix: handle invalid requests to the /app and /app_direct as Forbidden (instead of Internal Server Error and logging exceptions)
• Fix: do not parse commas (,) in the container-cmd property
• Fix: do not add Content-Length header when Transfer-Encoding header is present while injecting JavaScript file into the iframe