Micro-Policies for Web Session Security