Web Application Protection in practice