add a tornado test web server with XSS and SQL injection `enable`