Scenario 1 – Cookie header fuzzing