Remove executable flag.
Use cookie-based access token.