Just realised that nb2workflow already has access to the token. In dispatcher, the token is a parameter in SourceQuery. So it ends up in the request to backend. Then it needs to be added to the notebook run, probably as an environment variable.
We may use some convention, but dedicated annotation would be preferable.

The only edge case is when the notebook declares parameter named "token". Probably needs some change in the plugin.

Also to check if token affects job hash in nb2workflow. If so, needs to be underscored.

Reopening as #168 is still not merged