/actions/security/
../
refreshtoken.php