title: What is the standard way of an active client passing a SAML token to a relying party?
body: <p>I have a mobile client (iOS) and a web service (WCF, .NET 4.5) that I am securing using Windows Identity Foundation and SAML tokens. I have my client requesting SAML tokens from a custom STS, and once my relying party has that token I am able to deserialize it and verity its claims.</p>
  
  <p>However, I am uncertain if there is a standard way to send the token from the client to the relying party? I am guessing the token should be in the header of each request, but is there a common header or cookie name that is used when passing this type of token?</p>
  
  <p>I could see how you would want it to be different in all cases, in case multiple tokens were being passed back and forth, but I am wondering what the standard is for doing this.</p>