POST with no token                   -> 400 
POST with the attacker's own token   -> 400 
POST with the victim's own token     -> 302 /Bills/Detail/B2955
