Dear Manny,
CALLED_BY_PUBLIC_SERVICE means that you have both user/password set for service (in SICF) and XSRF set for HAP_DOCUMENT.
When there's an explicit call for "runtime->get_token()" (i mean "hardcoded" in page document_portal.htm), i assume XSRF protection set as per default, and cant be switched off.
Regards,
Adrian