Clicking on "Login" returns two cookies. One is "kitchen helper" and the other is its MD5 value. Just change both "kitchen helper" and its MD5 value to those of "grandma" and you can capture the flag