finished app without xss protection and a design patten