Unless I'm missing something, I think there is a problem somewhere. You say that a user should not be able to create an API token unless she has at least one permission in our app. Here the user you create has none, but you still create a token (bypassing your own rule) and then that user is allowed to avoid the rate limit. 

Now that I wrote that, I realize that it makes sense, but is very confusing. Changing this comment would probably make it all clearer. :)