To what should an application connect to retrieve security tokens?