Some URLs in my single-page-app (SPA) contain sensitive information like an access token, user informat