everything under the shadow
Kept in this browser only, and sent in the request body — never in the address bar, where it would end up in logs.