Post

authVerify?operation=reset&isGina=false

Hardcoding staff names into an API doesn't make me think that there is some opportunity to hack this at all.