Security is more like a seat belt than a technical challenge. Its time for developers to shift away from a product-first mentality and craft defenses that are built around user behaviors.