internal security review

We might have an external company audit the webapp. But for now we should start with an internal security review.

(from redmine: created on 2013-03-15, closed on 2013-07-15)