S220: Does not trust the me parameter

What this test does

Sends me= set to someone else's profile URL.

Your server either refuses, or signs you in as yourself. Returning the requested me without verifying it is a failure.