When a device (having a mobile app installed) wants to register (or update) the "token", the access to the backend needs to be protected