Is it possible to prove security properties about a web application?