AIC

Create one with aic-srv admin token create --name browser --scope user. The browser keeps a session cookie, not the token; revoking the token ends the session.