See https://incompleteness.me/blog/2007/04/02/good-marks-for-security-features-in-dwr/