Security Checklist

[rglover]

Need to document a pre-production security checklist:

• [ ] Utilize CSP (Content-Security-Policy)
• [ ] Utilize the sanitize option on getters and setters.
• [ ] Utilize (but be mindful) of the global sanitize option on the API via options.sanitize.
• [ ] Don't commit non-development (or non-destructive) settings files to repos.
• [ ] Utilize route-based context helpers like ifLoggedIn() and ifNotLoggedIn() (also: #85)

...