Token not validated at all (remove the parameter) - Token validated only if present (remove the parameter entirely) - Token not tied to session (use any valid token from any session) - Token reused across sessions (token never rotates)