title: One time created Web Api token is working on all request
body: <p>I want to ask Web Api token based authentication. As a user, I am creating a token on a web api. Token link is <code>http://mydomain/token</code> This request is returning a long token string. I am using this token to get secured data like this: </p>
  
  <p><code>http://mydomain/orders
   Accept:application/json
   Content-type:application/json
   Authorization: Bearer lksKaBgTgNT06LAWzHeLHiwMUI6nBHNvE2qen9............</code></p>
  
  <p>This header info is working with ajax request on Chrome browser. But same token is working with another browser Firefox or IE. </p>
  
  <p>Is this a security risk? If someone knows my token who listen network can access my data. Should I prevent this stuation with https? </p>