Document my reservations about the api_token technique in use.