title: How to correctly authenticate server-sent-event endpoint with firebase auth?
body: <p>I am using firebase for authentication with my custom server. This server exposes an endpoint for client to subscribe to server-sent-events. I initially open connection via <code>new EventSource(myApi.com?:firebaseToken)</code> and validate this token via admin sdk on the server.</p>
  <p>But I have few questions / concerns:</p>
  <ol>
  <li>Is it secure to send firebase token as a url parameter like that?</li>
  <li>What happens if user is connected to this event endpoint longer than lifetime of the token, i.e. token now becomes outdate?</li>
  </ol>