Authorize with a real credential to send real requests. They hit this server and do what they say. Your token is held for this browser session only and is never written to storage, so a reload asks for it again.