Show the user the application name and not the token

Hide the token, receive an application name in the parameters and use it to
ask permission to the user.