Authorize with a real credential to send real requests — they hit this server and do what they say. Your token is held for this browser session only and is never written to storage, so a reload asks for it again.