I would recommend to pair request with IP address, so in case, that somebody else catch the token, it is possible to load into page only through specific IP address. https://stackoverflow.com/questions/8107856/how-to-determine-a-users-ip-address-in-node