If you check the Shopify docs for the cart object you'll note that the token is missing. Referencing the value using {{ cart.token }} won't work so here's a method that can be used instead.

You'll note that the token exists in the object when output the contents using {{ cart | json }}. This means we can just split that string and grab the token for later use. 

You could do this with one line of code, but for easier reading it's shown with two.

grabbing the liquid snippet...

The above is pulled from the Shopify Snippets github repo.