What are a couple of easy to avoid front-end security pitfalls?