anchor.diff:      includes a matching `XSRF-TOKEN` cookie and `X-XSRF-TOKEN` header.
   
       XSRF/CSRF tokens should be unique per user and session, have a large random value generated by a
  -    cryptographically secure random number generator, and should expire in a day or two.
  +    cryptographically secure random number generator, and expire in a day or two.
   
       Your server may use a different cookie or header name for this purpose.
       An Angular application can customize cookie and header names by providing its own `CookieXSRFStrategy` values.
  
positive.code:     * `bypassSecurityTrustUrl`
      * `bypassSecurityTrustResourceUrl`
  
      Remember, whether a value is safe depends on context, so you need to choose the right context for
      your intended use of the value. Imagine that the following template needs to bind a URL to a
      `javascript:alert(...)` call:
  
  
negative.code: :marked
    ### Avoid direct use of the DOM APIs
  
    The built-in browser DOM APIs don't automatically protect you from security vulnerabilities.
    For example, `document`, the node available through `ElementRef`, and many third-party APIs
    contain unsafe methods. Avoid directly interacting with the DOM and instead use Angular
    templates where possible.
  
    ### Content security policy
  
    Content Security Policy (CSP) is a defense-in-depth
    technique to prevent XSS. To enable CSP, configure your web server to return an appropriate
    `Content-Security-Policy` HTTP header. Read more about content security policy at 
    [An Introduction to Content Security Policy](http://www.html5rocks.com/en/tutorials/security/content-security-policy/)
    on the HTML5Rocks website.
  
    <a id="offline-template-compiler"></a>
    ### Use the offline template compiler
  
    The offline template compiler prevents a whole class of vulnerabilities called template injection,
    and greatly improves application performance. Use the offline template compiler in production
    deployments; don't dynamically generate templates. Angular trusts template code, so generating
    templates, in particular templates containing user data, circumvents Angular's built-in protections. 
    For information about dynamically constructing forms in a safe way, see the 
    [Dynamic Forms](../cookbook/dynamic-form.html) cookbook page.
  
    ### Server-side XSS protection
  
  