If you use the same token on more than one website, it's not privacy-preserving anymore.