Stealing user session with open-redirect bug in Rails | Hacker News Reader