Testing for Integrity Flaws in Web Sessions