Google paid $90,000 after a DevSite flaw exposed a signing secret in a session cookie, enabling session forgery and remote ...