So we check if the `token`'s `user` still has the permissions since the time the token was created. If the permissions don't exist anymore, we delete the token. This arises when the user has been moved out of the permitted groups between the time the token was created and the time it is used.