Install and configure MopaBootstrapBundle.
Install and configure JMSTranslationBundle.
Remove security through obscurity measures: CSP URL is public.
Make session cookie HTTP-only and secure (transmit only over SSL).