The initial version of the SunPKCS11 provider does not properly support removable tokens (i.e. check for token present/changed, update mechanism list, etc.). It needs to be changed to do that.