wonder why they didn't implement something like privacy pass (private access tokens / private state tokens)