web application security   2 Stories