edit: kam corrected me below.

kam 9 days ago | parent [-]

The browser that initiated the request is under the control of BAD in step 3.

	▲	brettgriffin 9 days ago \| parent [-]
		ah, you are correct. thanks for pointing that out.