do not allow non-admins to register tokens with admin scopes