Language-Based Web Session Integrity