Web security is too hard