Easiest way is to use the <f:param>
in <h:commandXxx>
component. It basically adds a HTTP request parameter with exactly the specified name and value.
<h:commandButton ...>
<f:param name="MySecretToken" value="#{bean.mySecretToken}" />
</h:commandButton>
A more JSF-ish way would be to create a custom component for the job. E.g. <my:token />
. You could even create a custom component event listener which automagically adds this custom component to the form everytime.