We really need to discuss this then. Rationale for having this needing authentication is that clients do not know the uuids of the calls at the moment, they only know the tokens. In addition to that, because the token information is not stored on the server, we cannot ensure that the right person is revoking the call url.

The way we've done it currently needs the call urls to be persisted locally (on the client) and aren't known to the server, at all.

I prefer to rely on having the people that revoke this to be identified, rather than having them only know the uuid associated with the call-url.

Also, this is not meant to be used by a link clicker, but only by the link generator (who wants to revoke its url).