Comment by mmanulis

Why not pass the token as an HTTP header? e.g. X-RESET-TOKEN=foo and then read that via JS