Third-Party Features Leave Websites More Vulnerable to Attack