CSRF and XSS vulnerable web application