web security and content negotiation