removed todo tag, all server varibales are not trusted