While the protocol has made passwordless authentication a reality, token-binding is key to prevent against token theft and reuse, security vendor says.