How does silent authentication determine who’s requesting a new token?