A broken web app to teach web security