You seem to have a good bit of experience securing rails apps. Are there lessons hard learnt?