Users 'solution' to needing to always carry the token
"generate a code on an LCD display which they can use one time for access to the database through an authorised computer"
So the users won't blue tack the token to their 'authorised computer' along with PIN etc., thus allowing anyone passing by access ?