Allow for independent authenticity tokens per-scope

Confirming @markedmondson's issue #2640. Now with a workaround.