Unauthorised CocoaPods Auth via Token Leakage & HTTP Header Injection