This attack only works if your browser doesn't already have a cookie