Your token is kept only in this browser tab and sent as an Authorization header. It is never put in the URL.