Subscription endpoints are under /sub/<token>/