is
Endpoint URL carries the per-asset token in its body envelope and must always re-fetch to refresh; the redirected tileset.json is also session-bound to the bearer header so neither should be cached.