by-passing a prompt (showing why prompts don't work). The second for
by-passing CSRF tokens when XSS exists.
It also modifies the existing CSRF lesson so that the lesson
can be extended and used by the two new lessons.
git-svn-id: http://webgoat.googlecode.com/svn/trunk/webgoat@386 4033779f-a91e-0410-96ef-6bf7bf53c507
