A failed login, a valid token, and a company betting that security gets better when software has to prove it can break something.
