Do not ever provide a service over the web that controls something critical (house lights, surveillance cameras, bank accounts, car lock-out devices, street signs, traffic lights, bank accounts, stock trading accounts, etc.) without having at least rudimentary controls in place.