PASS: HTML escaping
PASS: CSRF token is random and stable per session
PASS: Dedicated MySQL DSN enforced
PASS: Password hashing round trip