CSRF vulnerability testing using a double-headed browser