Check that a change request token is a token

The validator for /api/auth_change_request's token was
m/[a-f|0-9|-]+/.  It had no anchors, so any string that held one hex
digit or a dash passed, and the | in the class was a literal character
rather than an alternation.  So it checked nothing.  The token is the
lowercase uuid that Trog::Utils::uuid makes, and the validator is now
m/\A[\da-f-]+\z/.  ProhibitEnumeratedClasses found it.  The lookup is a
placeholder query, so the old validator let nothing through to the
database that could do harm, but nothing was being checked.

The same file's form validator is [\w-], which under /aa is the class it
spelled out.

t/Trog-Routes-JSON.t fails three of its cases against the old pattern.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/Trog/Routes/JSON.pm

@@ -35,7 +35,7 @@ our %routes = (
         callback   => \&process_auth_change_request,
         captures   => ['token'],
         parameters => {
-            token => sub { my $tok = shift; $tok =~ m/[a-f|0-9|-]+/; },
+            token => sub { my $tok = shift; $tok =~ m/\A[\da-f-]+\z/; },
         },
         noindex    => 1,
         robot_name => '/api/auth_change_request/*',
@@ -46,7 +46,7 @@ our %routes = (
         parameters => {
 
             # Same shape series.json demands of child_form.
-            form => sub { $_[0] =~ m/^[A-Za-z0-9_-]+\.tx$/ },
+            form => sub { $_[0] =~ m/^[\w-]+\.tx$/ },
         },
         callback => \&posts_of_form,
         noindex  => 1,

t/Trog-Routes-JSON.t

@@ -0,0 +1,23 @@
+#!/usr/bin/env perl
+use 5.040;
+use re '/aasx';
+use warnings FATAL => 'all';
+
+use Test::More;
+
+use FindBin::libs;
+
+require_ok('Trog::Routes::JSON') or BAIL_OUT("Can't find SUT");
+
+subtest 'the change request token is a uuid, and nothing else' => sub {
+    no warnings 'once';
+    my $valid = $Trog::Routes::JSON::routes{'/api/auth_change_request/(.*)'}{parameters}{token};
+
+    ok( $valid->('5bed1745-4201-40dd-b5dd-65acc0316604'), 'a uuid is a token' );
+    ok( !$valid->(q{}),                                   'nothing is not' );
+    ok( !$valid->('x;drop table user'),                   'and neither is text with a hex digit in it' );
+    ok( !$valid->("5bed1745-4201\n"),                     'nor a token with something after it' );
+    ok( !$valid->('a|b'),                                 'nor a pipe, which the class used to hold' );
+};
+
+done_testing();