token-aware Widevine license URL, or null when the video is not DRM-protected. The TV fetches the license itself (no Referer header), so token authentication must ride on the URL.