tokens as params or HTTP headers == win.