feat: a token with limited access can be requested where no normal login is required