Need help: can't figure out how to init neutralino in a spawned window

[w-mcilhagga]

I'm writing a neutralino app where I want to open a new window with window.create('newwin.html', ...) . In newwin.html I have the following :

<script src="js/neutralino.js"></script>
<script>
    Neutralino.init()
</script>

(there's more in newwin.html but this is the bit I think matters)

The newly opened window then shows the following error:

NE_CL_IVCTOKN: Neutralinojs application cannot connect with the framework core using NL_TOKEN.

... and this is because NL_TOKEN is undefined in the new window.

Am I missing something about how to give the NL_TOKEN to the process running the new window? Could I do it with a query string or is there a better way?

[w-mcilhagga]

Well, setting tokenSecurity: "none" in neutralino.config.json works, but there's a big red warning about doing so. Any other way for getting the token to the new window would be appreciated