A developer creates an APEX application over confidential customer records. Which statement about security is correct?

1. Application authentication and authorization still need deliberate configuration
2. Hiding a navigation link is always sufficient to protect its page
3. Every authenticated user should be granted database-administrator privileges
4. Generated application pages cannot contain sensitive data