How Easy Are Session Tokens To Copy & How Do You Defend?