Step 1 runs automatically (writes MotionPoint stored preference; that endpoint has no origin/CSRF check). Then open www.metrobyt-mobile.com (signed in) and wait ~25s.