What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do?
Please note: I'm looking more for specific features that enhance security rather than just the basics like validating input, escaping input and output, XSS protection, SQL injection prevention, not showing errors, etc.