AttackerResource now has an image resource that can be switched to reply with 401 Unauthorized, requesting Basic Authentication.
OtherDomainResource now has a resource for benign Jsonp that requires a cookie. Made for demo of CSRF dangers with Jsonp.
The admin interface has a (still defunct) checkbox for switching image <-> 401 back and forth.
otherDomain.html now has the button for Jsonp that requires cookie.
Evil image demo page. Contains a screen scrape of John logged in at meetup.com.
The image to be switched.