That's a pretty good presentation, to me it's reiterating greybeard wisdom: browsers are insecure, server side is king. Another mitigation worth mentioning is

That's a pretty good presentation, to me it's reiterating greybeard wisdom: browsers are insecure, server side is king. Another mitigation worth mentioning is CSP - you can use it to limit the type of content that gets executed on your site, and from where they are allowed. That doesn't necessarily mitigate some of the attacks shown in the video, but mitigate a great deal.