If you though the last level was easy, this one is even easier. Alls we have to do is set revelio=1 for the win:

This one was really easy: Alls we have to do is set admin=1 for the win.  Let’s try: Well that didn’t work.  What’s up with this experimenter thing anyway?  I wonder what would happen if we used the PHPSESSID from that and made the same request?   Oh…that’s what happens.