The security documentation at https://jupyter-server.readthedocs.io/en/latest/operators/security.html is out of date.
It has a section that describes an additional one-time token used for browser launch, but this behaviour was replaced by a redirect file a few years ago in jupyter/notebook#4260.
Please could the docs be updated to describe the current implementation? Thanks!