added xss , and session test routes