Needs a changeCode token_in_url

Token sent in the address

API tokens must never be put in a web address, where they can end up in logs and shared links.