One thing the Symfony2 framework does that I sort of appreciate is limiting access to the page to calls from localhost only by default. It seems like that might mitigate some of the (no doubt gaping) security issues.