anchor.diff:      * `bypassSecurityTrustUrl`
       * `bypassSecurityTrustResourceUrl`
   
  -    Remember, whether a value is safe depends on context, so you need to choose the right context for
  +    Remember, whether a value is safe depends on context, so choose the right context for
       your intended use of the value. Imagine that the following template needs to bind a URL to a
       `javascript:alert(...)` call:
   
  
positive.code:   :marked
      Angular has built-in support to help prevent two common HTTP vulnerabilities, cross-site request
      forgery (CSRF or XSRF) and cross-site script inclusion (XSSI). Both of these must be mitigated primarily 
      on the server side, but Angular ships helpers to make integration on the client side easier.
  
    h3#xsrf Cross-site request forgery
    :marked
      In a cross-site request forgery (CSRF or XSRF), an attacker tricks the user into visiting
      a different web page (e.g. `evil.com`) with malignant code that secretly sends a malicious request 
      to your application's web server (e.g. `example-bank.com`). 
  
      Assume the user is logged into the application at `example-bank.com`.
      The user opens an email and clicks a link to `evil.com` which opens in a new tab.
  
      The `evil.com` page immediately sends a malicious request to `example-bank.com`.
      Perhaps it's a request to transfer money from the user's account to the attacker's account.
      The browser automatically sends the `example-bank.com` cookies (including the authentication cookie) with this request.
  
      The `example-bank.com` server, if it lacks XSRF protection, can't tell the difference between a legitimate request from the application
      and the forged request from `evil.com`.
  
      To prevent this, the application must ensure that a user request originates from the real
      application, not from a different site. 
  
negative.code: 
    :marked
      If you need to convert user input into a trusted value, use a
      controller method. The following template allows users to enter a YouTube video ID and load the
      corresponding video in an `<iframe>`. The `<iframe src>` attribute is a resource URL security
      context, because an untrusted source can, for example, smuggle in file downloads that unsuspecting users 
      could execute. So call a method on the controller to construct a trusted video URL, which causes
      Angular to allow binding into `<iframe src>`:
  
    +makeExcerpt('src/app/bypass-security.component.html', 'iframe')
    +makeExcerpt('src/app/bypass-security.component.ts ()', 'trust-video-url')
  