I am seeing similar behavior too for read API (for example get user by email api), master token and _uid are ignored when sending request. The document states that master token can be used, however it doesn't seem to be the case for all APIs.
Adding support to Google Maps API
Under what heading in plugin.json shall I specify the link to this external third-party script:
Also I do not want the API key exposed to the end users of the resulting HTML file.
To further clarify, the order of sequence of execution of scripts should be ...