I believe it is valid to have a way to hide authentication data as tokens passed through the header. ## For example: 