Browser DOM scan test (with session token)

Same as dom-scan-test.html, but a ?session=... token is generated at runtime and appended before the <video> element's src is set - the token never appears in the page source, only in the rendered element's resolved currentSrc. browser-dom-scan should find it; browser-network-sniff likely will too, for the same reason noted on the non-token version.