Use the viewer token printed by the VM startup script. It is sent only in the encrypted WebSocket message, not in this page URL.