How the British Airways' breach kickstarted today's web security challenge