Comment 7 for bug 316733

Here's how to solve that problem. When the user gets sent to the webpage for creating a new token, we say:

It looks like you already have some authentication tokens for application "Foo". Choose one of these tokens to give the application you're running now:

* Token 1 (read all data)
* Token 2 (write public data)
* Token 3 (write all data)

Or create a new token:
  * Read public data
  * Read all data
  * Write public data
  * Write all data

Like all other information we don't trust the client to handle, we present this information in the web browser.