facilitate stealing the users session by using his cookie