Update docs for checkin endpoint explaining token security