Auto-delete attacker's cookie and auto-destroy session on CSRF detection