This is a question about the 'files' array that you can return from a Moodle plugin that supports mobile, for example in its 'view' method.
The array includes objects with, among others, a 'fileurl' field.
In one of my plugins, I'm returning an image URL in this field like 
And in my template there is <img src="https://example.org/pluginfile.php/.../frog.jpg" alt="a frog">
The question is: should I actually be returning (and using in the img tag) a tokenpluginfile.php URL? Which seems to be the same except it doesn't need login and has a token in, like this code:
$token = get_user_key('core_files', $USER->id);
return $CFG->wwwroot . '/tokenpluginfile.php/' . $token . '/' . $context->id . [...]
The reason I ask is that I notice when you do it with pluginfile.php and it actually loads in the app, it roughly simultaneously loads both the pluginfile.php URL that I supplied, and a tokenpluginfile.php URL which the app has presumably generated itself. The pluginfile.php one, because of our server setup, causes a couple of redirects before failing and generally looks bad in the network panel - Is it ok to use tokenpluginfile.php if I want (to remove the extra URL load) or is that incorrect behaviour and I should stick to using pluginfile?
- Or, is it recommended to always return tokenpluginfile.php URLs?
--sam