What is session hijacking and what can hackers do with a stolen session?