Does it mostly just mean that, for non-JWT-style tokens, the same string essentially serves as both a "username" and a "password"?