SECURITY / 06
Reject valid-looking tokens when the referenced account is disabled, deleted, or no longer eligible.