I've used vapi web_sdk on frontend and is it's safe to use. Because when we initiate the call it sends the Bearer token in headers. So its safe to use ?