Client-side Attacks Require A New Approach to Web Application Security