Regular users should only be allowed to have limited project-less API token
    
    Basically, we do not want people to generate API tokens that could flag
    any PR on any project, potentially leading to invalid flag or abuse of
    the system.