web authentication tokens, like for cookies