Simulating a session fixation attack