Keeping the Web Open and Private in the Bot Era