Tighten constraints on endpoint token granters