/** Reuse the existing access identity without putting credentials in URLs or logs. */
export const coreFetch: typeof fetch = (input, init) => {
  const headers = new Headers(init?.headers);
  const token = typeof window === "undefined" ? null : window.sessionStorage.getItem("xingbang-access-token");
  if (token) headers.set("Authorization", `Bearer ${token}`);
  return globalThis.fetch(input, {...init, headers});
};