Comment by hamdingers

Sure, they probably do. Doesn't matter because neither the session key nor the token response can be linked to the tokens.

If you're not going to make an effort to understand how it works, don't make assertions about how it works. Ask your favorite LLM about the RFC if you have any further questions.