changed the client-side initial access token offered to the group provision app to user-based approval.