Testing CORS Token Hijacking on Doxy.me