sesskey is exposed in url for /user/managetoken.php

Throughout the test, ensure that the sesskey=... parameter is not present in the current URL Log in as admin Navigate to Advanced features in site administration Enable the following: Enable web services Enable RSS feeds Enable web services for mobile devices (if MDL-73414 hasn't been fixed). On 3.11 'Enable web services for mobile devices' setting is at Site administration > Mobile app > Mobile settings) Save changes RSS Keys Navigate to Preferences from the user menu Press Security keys Make a note of your current RSS key Press Reset (and Reset in the subsequent confirmation step) Confirm RSS key was reset (it's different to previous value) Security Keys Create a new user Assign this user as a Manager in the system context Log out Log in as new user Navigate to Preferences from the user menu Press Security keys Make a note of your current security key Press Reset (and Reset in the subsequent confirmation step) Confirm security key was reset (it's different to previous value)