[eurleif]

You shouldn't be able to get the token from another domain, regardless of how long it lasts. How are you able to?

[txt]

Im getting it on the same domain, but the request can be sent from any domain, as long as the user is logged in.