How to test session identifier strength with WebScarab