Read the whole thing. This is one the most succinct summary of how website "security" usually works that I have ever seen.