We can simply intercept the request to /admin and change the cookie as follow: After that, we can delete the user carlos and solve the lab.