default apitoken policy has * access for ssh keys #726