added mallory option for session hijacking