Defeating Prompt Injections by Design