Since changes related to SPEC-2968, the binder no more forge any token. It relies for that on the environment/context. When launching HTML5 applications, a token has to be created for the giving the same rights than what native applications have through their smack label and cynagora permissions. That token can be passed to HTML applications in the same way that it was done before changes from SPEC-2968.