Browser security framework WebSpec reveals new cookie attack