Test case for form hijacking