The token is exchanged for an HttpOnly browser session and is not stored in browser storage.