Security scenario analysis: token sprawl — failure modes, real-world examples, indicators and defensive countermeasures.