I am a little confused by this. What if someone intercepts the token for example and calls new Vapi(JWT TOKEN) Like multiple times on their end once they have the JWT token? Does Vapi enforce this one-time use?