Web application firewalls seem like a useful way to block application attacks, but I know of some people who are holding back on implementing them. What are the drawbacks to Web application firewalls?