Identifying vulnerabilities in cookies