SAMPLE EVIDENCE for AU-01 (made-up app Tidyhaus; not a real review) Both requests: HTTP 200, "If an account exists, we've sent a link." (same text).