People talk a lot of trash about frameworks like Rails, but I can spin up a shell application with bcrypt authentication via devise, roles-based authorization v

People talk a lot of trash about frameworks like Rails, but I can spin up a shell application with bcrypt authentication via devise, roles-based authorization via cancan or declarative authorization, built-in CSRF protection, and better-than-decent default XSS protection in less than 30 minutes. Granted, it's not perfect security-wise, but it beats the crap out of whatever mish-mash leads to this meltdown...or the one Citi had...or the one Sony had...or other one...etc. I think security is one of the few areas where convention over configuration pays off by sidestepping lazy/sloppy approaches.