Token tactics: How to prevent, detect, and respond to cloud token theft