Direct machine-to-machine channel requires pre-shared service header.

Browser user-agents do not transmit custom integration tokens by default.