Visitor Tracking Without Cookies (or How To Abuse HTTP 301s)