Question 3 and 4 on the [CS253 - Web Security page](https://web.stanford.edu/class/cs253/assign3), do not match the ones in [REPORT.md](https://github.com/stanford-web-security/assign3/blob/main/REPORT.md).
