system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
import urllib.request
import json
import requests
from pprint import pprint
import time
import pdb

f = open('key.txt')
API_KEY = f.read()
f.close()

def error_code(code):
    return (code > 400)

def get_routes(origin_id, destination_id, date_out, date_in):

    session_params = {
        'cabinclass':"Economy",
        'country':"UK",
        'currency':'GBP',
        'locale':'en-GB',
        'locationSchema':'iata',
        'originplace': origin_id,
        'destinationplace': destination_id,
        'outbounddate':date_out,
        'inbounddate':date_in,
        'adults':1,
        'apiKey': API_KEY,
        'limit':3
    }

    response = requests.post('http://partners.api.skyscanner.net/apiservices/pricing/v1.0', session_params)
    session_key = response.headers.get('location')
    print("Session key", session_key)
    if response.status_code != 201:
        return None

    json = None
    success = False
    while (not error_code(response.status_code)):
        print("POLLING")
        response = requests.get(session_key, {
            'apiKey': API_KEY
        }, headers={'Cache-Control': 'no-cache'})
        print(response.status_code, response.headers)

        if response.status_code == 200:
            json = response.json()
            if json['Status'] == 'UpdatesComplete':
                success = True
                break

        time.sleep(.25)

    if not success:
        return None


    itineraries = json['Itineraries']
    agents = json['Agents']

    result = []
    flights_itineraries = itineraries[0]

    if flights_itineraries:
        flights = itineraries[0]
        pricing_options = flights_itineraries['PricingOptions']
        for index, flight in enumerate(pricing_options):
            flight_price = pricing_options[index]['Price']
            flight_url = pricing_options[index]['DeeplinkUrl']
            agent = get_agent(agents, pricing_options[index]['Agents'][0])
            if agent is None:
                continue

            entry = {'price': flight_price, 'url': flight_url, 'agent': agent}
            result.append(entry)

    # Get the top 3 results
    return result[:3]

def get_agent(agents, agent_id):
    for _, agent in enumerate(agents):
        if agent['Id'] == agent_id:
            return agent

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-312: Cleartext Storage of Sensitive Information
  B) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  C) CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
  D) CWE-94: Improper Control of Generation of Code ('Code Injection')
  E) CWE-943: Improper Neutralization of Special Elements in Data Query Logic
  F) CWE-732: Incorrect Permission Assignment for Critical Resource
Answer: A