Updated CSRF exploits to target app-sec-demo.herokuapp.com