Server rejects a token the widget accepted
The widget hands over a token, but siteverify runs against an always-failing secret. Proves the server is the authority, not the client.
Expected HTTP 403 · invalid-input-response
Result
Submit the form to run this case.