I recommend Dancer, actually Dancer2 now. So easy to write web apps. Maintainable ones too! Most of the basics of app security are covered within the framework. And where there are gaps (like CSRF tokens), it's trivial to add primitives via DSL.