Remove permissions from GET /tokens/, /tokens/:id and POST /tokens

The list was always empty, and it doesn't exist anymore.