we need a STATIC_URL
proper tests for XSS