Webform / add hidden field with token
Fields with Secure value (allows use of all tokens) won't appear in your markup (that's why they are secured). They are 'created' on server side and are not available on Client Side. So nobody can't change their value (f.x. via XSS)

Hope it helps.