How is content protected from unauthorized access?

Every SCORM session is initiated with a short-lived signed token scoped to a specific learner, package and session window - preventing replay attacks and unauthorized access.