How would you test password reset abuse and token security?

Checking advanced practice access...