Security basics

The baseline every app integrating with CSI Auth is expected to meet
Report issue

Covers validating tokens on every request rather than trusting a session cookie, keeping redirect URIs exact, and handling secrets outside source control.