Return a 400 response if you try to reset an access token that isn’t yours.