The token stays in this browser tab and is sent only as a Bearer header.