      it "is not possible to take account over with the #{strategy} forgery protection strategy" do
        user = create(:user, email: 'legit@mail.com', password: 'password')

        post '/login', params: "spree_user[email]=legit@mail.com&spree_user[password]=password"
        begin
          put '/users/123456', params: 'user[email]=hacked@example.com'
        rescue
          # testing that the account is not compromised regardless of any raised
          # exception
        end

        expect(user.reload.email).to eq('legit@mail.com')
      end
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.