PoC endpoint (http) - session cookie theft demo for VOX Cinemas Bugcrowd report