The token must only be used for repositories that are registered in the
widget's saved options, matched by provider:identifier (not by fragile
cuid2 id). This prevents tokens from being sent to arbitrary providerUrl
values submitted by the caller.
The saved providerUrl is used in preference to the request's providerUrl
when a token is being applied.