Auth flaw in a android app and how to smash it for fun and profit :)