Make sure the token file is read-only to the owner

Signed-off-by: Yinan Li <liyinan926@gmail.com>