Isn't two-pass ROT13 an industry standard for the modern web?
I frequently find myself forced to deal with web forms that handle security-critical information, but depend on 3rd-party javascript, cross-site scripting, unexpected redirects to dodgy-looking domains, adobe flash widgets, invalid...