bearer tokens are sent in an HTTP header. However, SignalR is unable to set

The documentation on this page states the following:
`In standard web APIs, bearer tokens are sent in an HTTP header. However, SignalR is unable to set these headers in browsers when using some transports. **When using WebSockets and Server-Sent Events, the token is transmitted as a query string parameter.**`

As I understand developer does not have control over the code, to disable this dangerous fallback mode of sending auth. token?
Leaking the token means giving over full control over the resources owned by token.
Or, is the "query string" is meant to be a different mechanism of passing parameters from what I understand as "passing data in a clear text in url of a request"?

---
#### Document Details

⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*

* ID: d0da2144-3730-f8ef-1d16-a89f11fd6198
* Version Independent ID: 6d8f5bc8-8f5c-ba13-b7f2-0366eac46f81
* Content: [Authentication and authorization in ASP.NET Core SignalR](https://docs.microsoft.com/en-us/aspnet/core/signalr/authn-and-authz?view=aspnetcore-2.2)
* Content Source: [aspnetcore/signalr/authn-and-authz.md](https://github.com/aspnet/AspNetCore.Docs/blob/master/aspnetcore/signalr/authn-and-authz.md)
* Product: **aspnet-core**
* Technology: **aspnetcore-signalr**
* GitHub Login: @bradygaster
* Microsoft Alias: **bradyg**