__REASON__

The token is exchanged for a cookie scoped to /live, so it never appears in a URL — where it would be copied into access logs, browser history and referrer headers. Scripts can send Authorization: Bearer TOKEN instead.