Automating CSRF testing