anchor.diff:  If the serial number is not part of an allowed range, a
   409 Conflict + InvalidArgument error is returned.
   
  -In addition, a recovery key is generated by KBMAPI and stored as part of the
  +In addition, a recovery_token is generated by KBMAPI and stored as part of the
   token object.  This should be a random string of bytes generated by a random
   number generator suitable for cryptographic purposes.
   
  
positive.code: field, the decrypted `recovery_token` value is used as the signing key (in
  conjunction with some HMAC mechanism).
  
  If the request fails the authentication requests, a 401 Unauthorized error
  is returned.
  
  If all the checks succeed, the information from the old token (`:guid`) is
  moved to a history entry for that token.
  
  An example request:
  
  
negative.code:     "cn_uuid": "15966912-8fad-41cd-bd82-abe6468354b5",
      "guid": "97496DD1C8F053DE7450CD854D9C95B4",
      "pin": "123456",
      "recovery_tokens": [{
          "created": 123456789,
          "token": "jmzbhT2PXczgber9jyOSApRP337gkshM7EqK5gOhAcg="
      }, {
          "created": 2233445566,
          "token": "QmUgc3VyZSB0byBkcmluayB5b3VyIG92YWx0aW5l"
      }],
      "pubkeys": {
         "9e": "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYA...",
         "9d": "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYA...",
  