Lab 3A -- Missing State

Not logged in.

Mode: NOT checking state (vulnerable)

The interesting endpoint is /callback. Look at how little it checks.