4499ab3
Regular users should only be allowed to have limited project-less API token Basically, we do not want people to generate API tokens that could flag any PR on any project, potentially leading to invalid flag or abuse of the system.