POC of authentication bypass via chaining CSRF and type-juggling