Use the same shared bearer token that the JSON gateway accepts. This page stores it in an HTTP-only browser session cookie.