A URLSession delegate returns a credential from serverTrust without validation.
Validate the server trust with SecTrustEvaluateWithError or pinning before accepting.