This is just a workaround, but what if the user doesn't have javascript enabled? This will then will not work, find out how to put the token without using javascript.