JS version generates token anti-hotlinking