Why do web application firewalls appear so complex?