access token

Stored only in this browser (localStorage). During the spike this is the shared SPIKE_TOKEN; Cloudflare Access SSO replaces it in P1.