The Security Lottery: Measuring Client-Side Web Security Inconsistencies