as for the code wich sen't a session token, it was for verifing users, wich was in a public releas for like a week until someon from modrinth told me that it looks suspicus, and i get why so it was never used to steal any accounts or anyting like that, on that you have to trust me or more of obvTiger(owner of wireway.ch) as he made the verify server