A more realistic attack may steal the user's cookies