user db in memory
xss headers