The idea here is that the client shouldn't care what we send him, this could be a random token of any kind, encrypted/base64-encoded/signed. It is just supposed to be sent back as-is.