Limitation of use of third-party token

[shigeki]

It seems that a third-party token can not be valid as the wrong origin when it is written in the document as the first-party origin token.

If so, please clarify it in the FAQ that the third-party token can be used only loaded from the script.