Data retrieved from /auth/token/lookup* can include the token as `id`, which is plain-text. Make it a SecureString when returning the result.