Only /token URL will now return a session token, preventing a lot of extra cookies being created by spurious visits