Basically cookie/session hijacking as a service - what could go wrong?