CSRF PoC: Email Change Without Password

If you are logged into www.lascana.de, clicking submit sends customerEmailUpdate via GraphQL.

If CSRF works: redirect to lascana.de showing mutation response

If SameSite blocks: Cannot query field error (no session)