Authenticator provides a way to authenticate tokens provided as a parameter This only exists to allow websocket connections to use an API token, since they cannot set an Authorize header For this authenticator to work, tokens will be part of the request URL, and are more likely to be logged or otherwise exposed.