You have been tasked with securing a web application against XSS and CSRF attacks. What combination of security headers, practices, and designs would you use to mitigate the risk of these attacks?

Option (1) is correct. Implementing Content Security Policy (CSP) headers and using anti-CSRF tokens are effective measures to mitigate XSS and CSRF attacks. Options (2) and (4) are insecure practices that would increase vulnerability. Option (3) is incorrect as sensitive data should be encrypted, not stored in cookies without protection.