Bolt: A dumb CSRF scanner