Use daemon/sipb-xen.mit.edu and don't give user fake auth token in an HTML comment.