This seems unnecessary, should rely on UGI's token instead.

One special bad thing about Pepper's own token is its own (longer) timeout:
https://cs.chromium.org/chromium/src/content/renderer/pepper/pepper_plugin_instance_impl.cc?rcl=57ca87857c9c5b70f32a0638fa867c28c4331fb7&l=2264

Not sure why it was added in the first place when the underlying UGT expires sooner anyways.