[keycloak-user] token vs cookie for clients