With the security plugin, the auth token to be forwarded to an extension will be generated after successful authentication on a request destined for an extension. The actual request forwarding is performed in the extensions rest handler RestSendToExtensionAction. This handler needs to be able to obtain the generated token to forward to the extension.