usually the session server is hosted locally, which means the proxy tries to access the wrong url
if provided, cobalt will pull poToken & visitor_data from an instance of invidious' youtube-trusted-session-generator or its counterpart