Self-protected web applications