Update security and performance best practices

[crandmck]

This is a reminder to review these topics in light of the changes originally proposed in #1004 from @wesleytodd, which I closed due to extensive merge conflicts (it was 5+ years old).

If the fundamental changes in that PR are worth preserving, then let's open a new PR. If not, then we can close this, but I didn't want to just toss out the work since it covers some important topics.