Allow anyone to generate a token, restrict tokens to ActivityStreams::PhotosController#create, don't let tokens create sessions.