The token is validated by the lobby, then stored in an httpOnly cookie.