Web application code security writing considerations