CSRF demo for Application Security SIG