Don’t get pwned in 2018 - webapp lockdown checklist