Critical Bugfix: disallow sending the auth tokenover plaintext.