Me: We need to create our security architecture in the beginning. It's always harder to add when we have a bunch of functionality to work around.
Management: But we don't have time. We promised these features by January 1st. Don't worry about security yet - the initial version won't have critical business or customer data.
Me: We'll never have time. Once the users get ahold of this we'll be buried under requests for new features and critical bug fixes. Particularly since the only way we have to test it is to have people poke at it in a browser.
Management: Adding automated testing would take too much time.
Me: ...