im not understanding why you would need a waf at all