Function fresh_shared_token 

async fn fresh_shared_token<F, Fut>(fresh: F, connection_token: &str) -> String
where
    F: FnOnce() -> Fut,
    Fut: Future<Output = Option<String>>,

The shared account token for an HTTP call made during a connection: loaded fresh (fresh), the same way wan_publish and relay::relay_token load theirs. Not the connection’s token: that one is loaded once at connect, a desktop (PKCE) access token lives 15 minutes and a connection up to 2 hours, so after minute 15 every call made with it is a 401. For the W3-S key directory that turned every same-account WAN jekt network-claimed; for a lease release it left the lease held until it expired. The connection’s token is only the fallback when no fresh one can be loaded, and otherwise only authenticates the WebSocket handshake.