One thing that's not covered by a lot of frameworks is protecting against CSRF in AJAX requests. Django has some info on enabling this (https://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ajax), but it's easy to overlook.