Scenario 2 – User-defined cookie header fuzzing