New Research Paper: Pre-hijacking Attacks on Web User Accounts