This is to allow tokens to restrict the scope of the permissions the user has. The token should always restrict the permission set to a subset of permissions. It should never allow privilege escalation.

Example: A devurl token would have *.devurl.*.read to only allow reading of devurls.

Implementation notes

To prevent privilege escalation, just run Authorize() on both the user's permissions and the token's