Hey Stéphane,
The token (ticket) is there to prevent Cross-Site Request Forgery (Wikipedia: Cross-site request forgery). We don't currently have a way to generate or retrieve the ticket. The Session ID represents a Rest API session specifying the authenticated user.
I think you have a few options to move forward with depending on your use case:
- Use skinning to achieve what you want: You may be able to use our default component but adjust it using CSS and possibly some light javascript
- Use the AJAX approach with Rest API as you mentioned below: We have a configuration that allows you to use our cookie-based authentication for API calls (Rest API Authentication). This way you won't have to deal with the Session ID. Note: You would want to make sure to test this thoroughly and get this implementation reviewed by security so that you are not creating any CSRF vulnerabilities.
- Create a custom component that references the users.widgets.contact-me component (Take a look at the referencing a component section of Working with components). You can then hide other portions of the contact-me component contained in your component using css.
Hope this helps,
Yuri