Use WordPress built in constant for 1/2 day
Use hash_equals to avoid timing attacks
Output status code for invalid endpoint
move invalid endpoiint error to after content type
12 hours is better than 1/2 day