diff --git a/CHANGELOG.md b/CHANGELOG.md
index f7a78c0fc..8c602e292 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,8 @@
   * don't try to join invalid channels
   * don't try to get their metadata
 * prompt premium users to cancel their subscriptions before deleting their accounts
+* check that headers for XLSX export are correctly set via the checkup app
+* guard against some type errors in the support page
 
 # 4.3.1
 
diff --git a/customize.dist/src/less2/pages/page-checkup.less b/customize.dist/src/less2/pages/page-checkup.less
index 2a05600c7..9119a4b72 100644
--- a/customize.dist/src/less2/pages/page-checkup.less
+++ b/customize.dist/src/less2/pages/page-checkup.less
@@ -52,7 +52,7 @@ html, body {
 
     .advisory-text {
         display: inline-block;
-        word-break: break-all;
+        word-break: break-word;
         padding: 5px;
         //font-size: 16px;
         border: 1px solid red;
diff --git a/www/checkup/main.js b/www/checkup/main.js
index 5dcd1e8cf..42864b4f3 100644
--- a/www/checkup/main.js
+++ b/www/checkup/main.js
@@ -202,6 +202,24 @@ define([
 
     }, _alert("Login block is not working (write/read/remove)"));
 
+    assert(function (cb) {
+        var url = '/common/onlyoffice/v4/web-apps/apps/spreadsheeteditor/main/index.html';
+        var expect = {
+            'cross-origin-resource-policy': 'cross-origin',
+            'cross-origin-embedder-policy': 'require-corp',
+        };
+
+        $.ajax(url, {
+            success: function (data, textStatus, xhr) {
+                cb(!Object.keys(expect).some(function (k) {
+                    var response = xhr.getResponseHeader(k);
+                    console.log(k, response);
+                    return response !== expect[k];
+                }));
+            },
+        });
+    }, _alert("Missing HTTP headers required for XLSX export"));
+
     var row = function (cells) {
         return h('tr', cells.map(function (cell) {
             return h('td', cell);
diff --git a/www/common/onlyoffice/inner.js b/www/common/onlyoffice/inner.js
index 5775eb4f6..eee9f6883 100644
--- a/www/common/onlyoffice/inner.js
+++ b/www/common/onlyoffice/inner.js
@@ -2554,6 +2554,7 @@ define([
                 newDoc = !content.hashes || Object.keys(content.hashes).length === 0;
             } else if (!privateData.isNewFile) {
                 // This is an empty doc but not a new file: error
+                // XXX clear cache before reloading
                 UI.errorLoadingScreen(Messages.unableToDisplay, false, function () {
                     common.gotoURL('');
                 });
diff --git a/www/support/inner.js b/www/support/inner.js
index 0c70e7900..aee0e347a 100644
--- a/www/support/inner.js
+++ b/www/support/inner.js
@@ -203,6 +203,7 @@ define([
     };
     var showCategories = function (cat) {
         hideCategories();
+        if (!Array.isArray(cat)) { return void console.error("invalid category"); }
         cat.forEach(function (c) {
             APP.$rightside.find('.'+c).show();
         });
@@ -214,6 +215,7 @@ define([
         var metadataMgr = common.getMetadataMgr();
         var privateData = metadataMgr.getPrivateData();
         var active = privateData.category || 'tickets';
+        if (!categories[active]) { active = 'tickets'; }
         common.setHash(active);
         Object.keys(categories).forEach(function (key) {
             var $category = $('<div>', {