Secure default configuration for asp.net