Web Application Security is Broken. What Comes Next?