JavaScript Security Essentials: Exploring the Attack Surface