`create_token_perm` permission might be a vulnerability

[JohnTheCoolingFan]

This permission allows creating tokens with any other permissions.

Possible solutions:

1. Remove the permission entirely, use master token or admin permission instead.
2. Only allow creating tokens with permissions that are enabled for the token that created it.

[JohnTheCoolingFan]

Removed the permission entirely