part 2 of startup security-  xss