The "Requires Authentication" doesn't really make sense for a link-clicker.

What makes sense here (and I show this at https://wiki.mozilla.org/Loop/Architecture#User_Abandons_Ringing_Call) is that you don't DELETE /calls/{token} -- you DELETE /calls/{callid}