Stealing user session with open-redirect bug in Rails | Dark Hacker News