Returned by sign-up, sign-in and a password change. The client keeps both tokens with its session.
token: string
Sent as Authorization: Bearer …, and as ?token= to the WebSocket.
mediaToken: string
Carried as ?token= by the URLs of private media. It can read media and
nothing else.