Testing for Session puzzling (OWASP-SM-008)