How is the token returned from this? In `Response#authorization`?