Tokens are held in memory only — nothing is written to browser storage.
Demo: leave both fields blank to sign in as admin@honeypot.io