Authenticated vulnerability scanning breaks on OAuth, MFA, and CAPTCHA. See how to hold a real session and test the surface ...