Exposing Vulnerabilities in Session Token Generation