What is used to validate the authenticity of the client and is sent in HTTP requests as a JSON object?