xss and other headers didn't work here....i'm learning nginx i suppose !