Web apps are so complex that they are not safe to use, researchers say