Right, though the link is not injected by the content server since we don't know the token. We return this as-is for the auth-server to fill in.