Change internal representation of access grants. Since there is no client authentication in the OAuth flow, you can't key permissions by client ID without risking that a spoof client will implicitly gain access to scopes it shouldn't. Instead, we issue a new random token for every access grant and store permissions keyed by that.