@jreschke ask @planetlevel re: “unless I'm missing something, the developers of the #esapi java library confuse security with obscurity”