The browser that initiated the request is under the control of BAD in step 3.
ah, you are correct. thanks for pointing that out.