SSL/TLS session-aware user authentication - Or how to effectively thwart the man-in-the-middle