Relax token scope; see #2862
Merge pull request #2865 from gratipay/relax-token-scope

relax token scope