Open a back-office address without the security token, as a pasted or bookmarked link would: the back office answers with its "Invalid token" page.
Examples
When I open the back office path "sell/catalog/products/" without the security token
When I open the back office path "sell/orders/" without the security token
When we open the back office path "improve/modules/manage" without the security token
And I open the back office path "sell/customers/" without the security token
When I open the back office path "configure/advanced/employees/" without the security token
Pattern
When(/^(I |we )*open the back office path "([^"]*)" without the security token$/, …)
Part of @webship-js/prestashop-steps (github.com/webship/prestashop-steps), a step pack for Webship-js 2.0.x.