* Fix outdated DNS entries from `https-certs` SAN
* gatekeeper: Add preservation of query subpaths/params before redirecting