Back in the Stone Age, we called these “Webrings,” but they weren’t as fancy.

One of the issues that I faced, while developing an open-source application framework, was that hosting that used FastCGI, would not honor Auth headers, so I was forced to pass the tokens in the query. It sucked, because that makes copy/paste of the Web address a real problem. It would often contain tokens. I guess maybe this has been fixed?

In the backends that I control, and aren’t required to make available to any and all, I use headers.