You are what you include: large-scale evaluation of remote javascript inclusions
Reining in the web with content security policy