Tokens give you permissions over a set of entities. When an entity is created it defines its set. Permissions are, read, write, change_entity_set, and create_token. The latter two are unused as of now. Tokens also define their "root entities" so they can be used directly in links to give access. This may later prove to be a bad idea, but works for now! In the code we add the context of EntitySetProvider. For now there is just on at the top level of a doc, but we will need to wrap other sections of the tree if we implement scoped permissions.