The server's clock, so a client can render in server-time space instead of guessing from HTTP Date headers, which have one-second resolution.

Unauthenticated on purpose: a clock is not a secret, and a client needs it before it has finished signing in.