Unauthenticated SSRF via Public Reference API -Sharing Token Bypass

Summary

We're considering this a non-issue at the moment. Only one reference provider actually handle the share token as only they actually support public share link information. In that case providing a wrong share token also means no information from the link is actually matched. So this is totally fine.