Finding Bugs in Web Applications Using Dynamic Test Generation and Explicit-State Model Checking