Opinion: Why application-layer defenses belong in the applications