Disable stuffs that are not gonna be used
Authorize before showing form if token have never been filled up
Force SSL on production
Documentation