Currently, we generate a large number of JWTs
for Geo - one per file synced, per secondary.
They are short-lived but do not have any restrictions
on scope, so a token valid for downloading one file
or repo could, in theory, be used to download another.

In this commit we add scope to every token but not
enforce it yet.