whack-a-mole CTF server: POST /session then POST /submit