anchor.diff:  
   Once the entry is updated or created in moray, a successful response is
   returned (201) and the generated recovery token is included in the response.
  +The recovery token is encoded as base64.
   
   Example request (with attestation)
   
  
positive.code: conjunction with some HMAC mechanism).
  
  Instead of HTTP Signature auth using the SSH key, HMAC signature using the
  `recovery_token` as value will be used.
  
  If the lost PIV token does not exists in KBMAPI we should reject the request with
  a `404 Not Found` response.
  
negative.code: An example request:
  
  ----
  POST /pivtokens/97496DD1C8F053DE7450CD854D9C95B4/replace
  Host: kbmapi.mytriton.example.com
  Date: Thu, 13 Feb 2019 20:01:02 GMT
  Authorization: Signature keyId="xxxx",algorithm="hmac-sha512",headers="date",signature="<Base64(hmac-sha512($Date, $recovery_token))>"
  Accept-Version: ~1
  Accept: application/json
  
  