Developers who don't realize such basic elements of how their application actually works have no chance of creating a secure web-app.