Inline token encoding as URI with capability fragment