The token is stored locally in your browser and only attached to protected `/api` calls.
No token saved yet.