Right.

Seems like the token is the one secure piece in the 3x verification.

Need two more secure pieces.