Third-Party Auth Token Theft: The Big Picture