TokenLocation: "headers" | "querystring" | string