Demo web app showing common security mistakes.