XE not EX
add some comments
add open redirect