[Web] fix token handling