I think ideally it would be a temporary auth token, only used to get the session created.