Morning, we are evaluating Vapi, moving over from Elevenlabs. How do we secure our Vapi assistants? If we only have a public api token, anyone can start calls from our web sdk. Is there no way of generating a one off user token to start a call?