added a vuln for broken auth and session mgmt, issue #2