staff xml and xsd added
simple secure path filter