HUMAN VERIFICATION REQUIRED ASVS 7.2.2 Session tokens are dynamically generated

The application uses either self-contained or reference tokens that are dynamically generated for session management, i.e. not using static API secrets and keys.