hubUrlWithBrowserBearer function
The browser bearer equivalent: ?token=<url-encoded secret>.
Browser WebSocket cannot set an Authorization header. Keep the protocol's query-parameter name isolated here so every browser host uses the same authentication path. The returned URI contains a credential: never log it or include it in an exception.
Implementation
Uri hubUrlWithBrowserBearer(Uri url, String secret) =>
url.replace(queryParameters: {...url.queryParameters, 'token': secret});