Cursed Stale Policy: abuse websocket to cross the web trust boundary and recover the flag.