Lessons Learned from Securing Web Apps and APIs at Internet Scale