I'm a huge fan of the Tangled Web, but if you leverage stuff that modern browsers give you, you don't really need worry about most of the content discussed in the book. (I'm still a fan of the book from a web security history point of view).

Specifically, if you have CSP headers you can pretty much ignore XSS risks. Add something to handle CSRF (e.g. Original header or the more traditional cookie/post param) and you are golden.

I haven't read the web application hacker's handbook but I bet I'll reach a similar conclusion.