If your browser supports using certificates from the token, you can setup HTTPS client authentication on the server and your PHP script can just read the user name from environment variables.
Successful deployment of such a setup involves a lot of infrastructure (typically IIS/Apache, Windows Domain and certificate service), user training and support though.
Normally this is implemented using PKI smart cards (which a lot of these USB tokens emulate) that is also used to log the user into the computer. The user will have a strong incentive to remove the card/token when leaving the computer so to protect files stored in the account. Also, Windows logo-compliant smart cards automatically locks itself when the user locks the computer, so the user must enter the PIN again to unlock the card and the computer. This setup partially solves the issues raised by @WhiteWinterWolf.