it accepts any token/key in the Auth header, and uses that as the isolation key