remove hidden token field

initially the token is hidden when the token value is part of the URL