Web Security For Developers: Real Threats, Practical Defense