Instance token

This console is reachable beyond loopback, so it takes the same token as the API — INSTANCE_TOKEN from secondlayer init.