Defenses against web application attacks