aaronpkit is read-only, so it's your choice whether you want to prevent "public" access to your webmentions (by keeping the token only on your server and accessing the API), or treat your webmentions as public by putting the URL with the token in some javascript
