How the token-based remember-me feature works