[eddythompson80]

That's not true. There is a JWT token in the url with about 5 minute expiration window.