[Web] refactor / fix token handling