Return token on addition.
Use proxied scripts to access whole system in order to allow unprivileged user
to manage own tokens.
Update roles immediately in order to give unprivileged user access to
validated token.