Members sign in with Google. A token is for break-glass or accounts without SSO. Credentials and your session cookie are HTTPS-only.