Gregory's Server@darius got it. So, it sounds like I should maybe update my API calls so that there are public and private versions. Public uses no bearer token, and is the default unless somebody is authenticated, at which point their localstorage token is used in the authenticated version of the call.
Thinking on it, maybe the calls can have some if-else logic to detect whether a user is logged in, so that I don't have to double-code everything. 😛
Thinking on it, maybe the calls can have some if-else logic to detect whether a user is logged in, so that I don't have to double-code everything. 😛
@sean exactly the first thing you said. The if/else thing could work but it's unusual for an endpoint to give two different results (other than say 200 vs 401) when authenticated or not. Typically you would render a different view template if logged in that accesses a different set of endpoints.