I'm a little bit confused by this code.  It seems like the "user token" and the "server token" are getting conflated a bit?

My understanding of the protocol was that

1) Each server needed to get a server token for itself and keep it active.
2) Each server needs to include its server token on other requests (like when hitting the `/token` endpoint with a user token) in order to ensure it has permissions to do things

It appears that this code is instead getting a server token on each request.  Which might be correct and I'm just mistaken on the protocol, but it has made it clear to me that I'm not 100% on the protocol.