A demonstration app for Cross-Site Request Forgery