Discovery of user hashes is mathematically impossible (you could do that through GET anyway), and the different error codes gives us a chance to tell the token is wrong (although this should never happen).