Made a note about user how permissions are applied when attempting to create a
token for another user.  Test for this case already exists.  closes #2350.