Permanent Token not possible, right?

This post describes the workaround for web apps.