Token stored in your session only — never saved to disk