We can detect what IP the request is coming from, and not even require a token. Maybe we should even support all record types.