Must allow member for site tokens as well